Sophisticated Malware Campaign Exploits Steam Workshop to Target Gamers A recent malware campaign has leveraged Steam Workshop and Wallpaper Engine to distribute backdoors, infostealers, and crypto miners, primarily affecting gamers in China (89% of cases) and Russia (5.5%), with additional infections reported in Singapore, Hong Kong, Germany, Vietnam, India, and Canada. ### How the Attack Works Threat actors abused Wallpaper Engine’s "application" wallpaper type, which allows standalone executables to run as animated desktop backgrounds. By embedding malicious payloads within these wallpapers often hidden in password-protected archives or bundled with legitimate files attackers tricked users into executing arbitrary code upon installation. Once activated, the malware deployed in multiple stages: 1. A backdoor (e.g., Synaptics.exe, linked to the DarkKomet family) was dropped. 2. A secondary module (e.g., ._cache_GAME1.exe) installed a tampered system library (AggregatorHost.dll). 3. The library hijacked active Steam sessions, harvesting authentication tokens and credentials. 4. Stolen data was exfiltrated to attacker-controlled servers (e.g., hxxp://120.48.156[.]17/ey.php), enabling account takeovers and further malicious uploads via compromised profiles. ### Malware Arsenal & Impact The campaign distributed a diverse toolkit, including: - Infostealers (Vidar, Lumma) - Backdoors (DarkKomet) - Crypto miners (sapping system resources) - Ransomware variants - Python-based trojans Localized artwork and titles suggested deliberate targeting of Chinese users, though the infrastructure could be repurposed globally. ### Steam’s Response & Detection Steam removed identified malicious Workshop items, but the incident highlights platform moderation challenges against persistent abuse. Security vendors detected samples using heuristics like HEUR:Trojan-PSW.Win32.gen and HEUR:Backdoor.Win32.DarkKomet, though proactive defenses are required to mitigate risks. The attack underscores a growing trend: legitimate community platforms are increasingly weaponized to bypass traditional security measures.

New DDoS Botnet Targets Valve Source Engine Game Servers via Exposed Jenkins Instances Security researchers at Darktrace uncovered a sophisticated DDoS botnet exploiting misconfigured Jenkins servers to launch attacks against Valve Source Engine game infrastructure, including Counter-Strike and Team Fortress 2 servers. The malware, first detected on March 18, 2026, via Darktrace’s CloudyPots honeypot network, stands out for its cross-platform capabilities and precise targeting of the gaming sector a growing focus for cybercriminals, which Cloudflare ranks as the fourth most attacked industry globally. The attack begins with threat actors scanning for Jenkins instances with weak or default credentials, leveraging an exposed remote code execution (RCE) endpoint to deploy malicious payloads. Once inside, the malware delivers Windows and Linux variants: on Windows, it downloads a disguised system update file, while on Linux, it executes a Bash script to fetch and run a payload from the /tmp directory. Both use a Vietnamese-hosted IP (103[.]177.110.202) for command-and-control (C2) and payload delivery an unusual consolidation that reduces operational resilience. The botnet employs multiple DDoS techniques, including UDP floods, TCP push attacks, and HTTP request floods, with a particularly effective method called "attack_dayz." This tactic exploits Valve Source Engine’s query protocol, sending small requests that trigger disproportionately large responses, overwhelming servers with minimal attacker bandwidth. The malware also ensures persistence by: - Manipulating Jenkins environment variables ("dontKillMe") to evade process timeouts. - Renaming itself to mimic legitimate Linux kernel processes ("ksoftirqd/0" or "kworker"). - Using double forking and redirecting logs to /dev/null to avoid detection. - Ignoring termination signals (SIGTERM) to resist manual shutdowns. Once active, the malware connects to the C2 server, reporting system details and awaiting attack commands. It supports three utility functions: PING (keep-alive), !stop (termination), and !update (self-updating). Darktrace recommends blocking TCP port 5444 (used for C2 communication) and the identified attacker IP at the network perimeter, alongside securing Jenkins instances with strong authentication and restricting public access.

Valve Corporation, the owner of Steam, faced a potential breach involving the leak of 89 million Steam user records with one-time access codes. The data was advertised for sale by a threat actor known as Machine1337. A sample of 3,000 records, containing historic SMS text messages with one-time passcodes for Steam, was examined by BleepingComputer. The incident is suspected to be a supply-chain compromise involving Twilio, a cloud communications company providing APIs for SMS and 2FA messages. Twilio denied any breach, but acknowledged investigating the situation. The data's origin is unclear, but it may come from an SMS provider intermediating communication between Twilio and Steam users. Steam users are advised to enable Steam Guard Mobile Authenticator for added security.

Valve Corporation experienced a significant cybersecurity incident when the game PirateFi on its Steam platform was found to contain malicious code, designed to steal browser cookies and hijack accounts. The malware, identified as 'Trojan.Win32.Lazzzy.gen', prompted Valve to advise affected users to undertake a full reformat of their operating systems to eradicate the threat. This action indicates a substantial impact, where personal user data was likely compromised. The scale of the incident is notable, with an estimated reach of over 800 users who downloaded the game. The immediate removal of the game and public notification highlight Valve's response to containing the situation and preventing further damage.

The California Office of the Attorney General reported a data breach involving Valve Corporation on February 8, 2012. The breach is related to a network intrusion that likely resulted in the unauthorized access to a database containing user names, email addresses, encrypted billing addresses, and encrypted credit card information, although no evidence of credit card misuse has been found.