Cráb People

Anyone who has an authenticator attached to their account should run a search (and probably an antivirus scan in case it's on the threat list already) immediately and ensure the file emcor.dll does not exist on your computer. This file is one reported to be allowing hackers that have authenticators attached to them. It's also possible there are other variations of these suspicious files, so if anyone has additional information please respond in the comments.

, the file may be found in /users/username/appdata/Temp. Since the file is fairly new (first mentions of it are only a few days ago), and the common source is unknown, I urge everyone to not log in to World of Warcraft or the account management site until you've run a scan. Confirm your computer is secure before using your authenticator, because this DLL file is allowing hackers to crack through it and access your account.

A warning sign that you're currently infected with this keylogger is that WoW will say your authentication code is incorrect, even if you know for sure you typed in the correct code. Thanks to Cameron for posting about this in our forums, too.

The auth itself isnt unsafe but people shouldnt disable it if they see messages that the key is wrong.

If you see that your authenticator key is wrong even if you typed it correct, you most likely have the keylogge. You should then quickly click the authenticator again to create a new key so the other one gets disabled, then quickly go change your account password, just to be safe. Then go find the keylogger and destroy it. That's how I think it works.

Its a classic keylogger but it gives a wrong key message even if you typed a correct key.
The idea is, that you type many valid keys into it and the "hacker" can use it to get your account.

Imo that isnt that dangerous.
The "hacker" needs to be there and needs to react fast, entering your valid keys in a what, 40sec timeframe.
Even then the auth is still active, to disable the auth from the account, he needs the serial, which is usually not stored on the pc.
Mobile auth have it stored on the phone but what is the chance that you got hacked on your phone and your pc at the same time and the person has to know that account x is part of mobile auth y.

I would think it just simply blocks you telling you that the key is wrong, combined with a key logger so that when you get fed up and remove the authenticator the hacker gets your password. Getting results off your keylogger in real time and using them within such a short time slot seems unreasonably taxing on the hacker compared to the good old deny service until victim agrees to use less secure authentication method.

read mmo-champion its explained how it works there