Dont open any old COD's anymore. Learned this the hard way, yes it is still happening. No it has not been patched, regardless of what Activision claims. Heres a long explanation written by some guy.

POSTED: JUNE 26
Good game, one of the best in the series but I can not recommend.
DO NOT BUY.
While it is still possible to play zombies safely with the use of community patches you can not play public servers safely and activision are actively removing safe ways of playing the game.

*DO NOT OPEN ANY COD PRIOR TO IW*
They took away Xlabs, Sm2, and soon will take away Plutonium which are all the ONLY safe way to play these older CoDs.
Opening any CoD prior to IW will result in a chance for people to gain access to your pc. 2 security breaches are known:
CVE-2018-20817
(SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.)
CVE-2018-10718
(Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crafted packets)
These are some things they can do even if you just boot up the game and get to the menu:
Hidden Remote System Access
System Information
File Manager
Hidden Desktop Usage
Monitor on/off
Hidden Browser Usage
Open/close CD
Hidden Chrome Usage
Show/Hide taskbar
Start Up Manager
Hidden Firefox Usage
Show/Hide Start Button
Task Manager
Hidden Edge Usage
Show/Hide Explorer
Remote Shell Usage
Show/Hide Clock
TCP Connection
Show/Hide Tray
Reverse Proxy
Show/Hide Mouse
Registry Editor
Hidden Explorer
Enable/Disable TaskMgr
UAC Exploit
Enable/Disable Regedit
Disable WD
Disable UAC
Format All Drives
DDOS attack
Audio recording
Webcam recording
Device information
Process hollowing
Credential stealing
Discord token stealing

Report every older CoD as harmful and put those 2 CVE's under the description why.
Write negative reviews to warn others not to spend any money on these CoDs (which are mostly overpriced for how old they are as it is)
We need to take these CoDs from "Positive" or "Mostly Positive" to mixed or mostly negative
 

Why is this game still $40?

CVE-2018-10718
Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote attackers to execute arbitrary code via crafted packets.

CVE-2018-20817
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.
Bo3 is also included as it does not protect you from any security breaches.
For anyone who isn't experienced with this kind of thing, RAT stands for "Remote Access Trojan".

What the attacker has access to/can do:
Hidden Remote System Access
System Information
File Manager
Hidden Desktop Usage
Monitor on/off
Hidden Browser Usage
Open/close CD
Hidden Chrome Usage
Show/Hide taskbar
Start Up Manager
Hidden Firefox Usage
Show/Hide Start Button
Task Manager
Hidden Edge Usage
Show/Hide Explorer
Remote Shell Usage
Show/Hide Clock
TCP Connection
Show/Hide Tray
Reverse Proxy
Show/Hide Mouse
Registry Editor
Hidden Explorer
Enable/Disable TaskMgr
UAC Exploit
Enable/Disable Regedit
Disable WD
Disable UAC
Format All Drives
DDOS attack
Audio recording
Webcam recording
Device information
Process hollowing
Credential stealing
Discord token stealing