Loading story…
The FBI is seeking victims as it investigates a suspected cybercriminal who published multiple malware-tainted games on Steam, using seemingly legitimate titles as Trojan horses to infect players' systems. The games named by the agency include BlockBlasters/BlockBasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova, and were reportedly available between 2024 and 2026. Both reports indicate the titles were functional enough to appear legitimate, but were designed to deliver malware and compromise users after installation.
The reported impact includes account compromise, information theft, and crypto-wallet draining, with one cited case involving the theft of $32,000 in cancer donations from a streamer after exposure to one of the malicious games. The investigation suggests the listed titles may have been developed by the same threat actor, and that the number of affected users remains unknown. The case also highlights ongoing weaknesses in marketplace screening, as malicious games were able to reach Steam users before being removed by Valve.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Following disclosure of the investigation, Steam was reported as advising affected users to look for malicious files, run antivirus scans, review installed software, and consider reinstalling their operating system. This guidance reflected the risk of persistent compromise from the malicious game installs.
Reporting on the FBI inquiry identified the games BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova, and linked them to malware including cryptodrainers, HijackLoader, Vidar, and Fickle Stealer. Articles also described promotion via Discord and Telegram and follow-up social engineering to obtain verification codes for deeper account access.
On March 13, 2026, the FBI's Seattle Division announced it was investigating a suspected cybercriminal behind multiple malware-laced Steam games and asked victims or guardians to submit information. The agency said victim identification could support the investigation, restitution, and victim services, and provided a reporting form and Steam_Malware@fbi.gov for submissions.
The FBI said the investigated campaign involved games hosted on Steam through January 2026, indicating the operation continued into early 2026. Some malicious functionality may have been introduced through later updates after initial release.
Valve removed the malware-laced titles from Steam after they were identified as malicious. The exact number of infected users remained unknown, though one title was reported to have up to 1,500 downloads before removal.
The malicious Steam game PirateFi reportedly reached more than 7,000 players before Valve removed it. Valve also advised affected users to reformat their operating systems after the game's removal.
One of the malicious Steam titles, BlockBlasters, was reported to have led to more than $32,000 in cryptocurrency theft from a streamer after a malicious file was injected into the game. Community losses tied to BlockBlasters were later estimated as high as $150,000.
During 2025, separate malicious games were reported on Steam that functioned as basic games while acting as Trojan horses to infect players' computers. This established that malware distribution through Steam had already occurred before the broader FBI-linked investigation was publicized.
A campaign of malicious games started being distributed on Steam in May 2024, with titles later tied to cryptocurrency theft, credential theft, browser-session hijacking, and account compromise. The FBI later said the affected games were available between May 2024 and January 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
bgr.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcepcgamer.com
Open sourcetomshardware.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Federal agents arrested 21-year-old Florida resident **Zyaire Dontaevious Zamarion Wilkins** in connection with a malware operation that allegedly hid malicious code inside multiple games distributed on **Steam**, infecting about **8,000 devices** and stealing at least **$220,000** from roughly **80 cryptocurrency wallets**. Prosecutors said the games—including **BlockBlasters**, **Dashverse**, **Lampy**, **Lunara**, and **PirateFi**—were used to steal credentials and other data and to drain victims’ crypto holdings, while Valve removed several of the titles after they were identified as malicious. According to the criminal complaint, Wilkins allegedly financed and marketed the scheme under the handle **`Sibel.eth`**, while an unidentified developer created the malware and the games were promoted through **Discord, LinkedIn, and Telegram**. Investigators linked the stolen cryptocurrency to Wilkins by tracing Bitcoin used to buy more than 150 gift cards, including purchases redeemed through **Uber Eats** deliveries tied to his home and university addresses; the FBI had previously issued a public request for victim information as part of its Steam malware investigation and later seized devices and digital wallets during a search of his residence.
Jul 21, 2026
Researchers reported that **BloodyStealer**, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including **Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld**, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems. The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as **KeyBase** and **Agent Tesla**, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Aug 15, 2026
A new malware campaign has targeted users of the indie game platform *Itch.io* and Patreon by distributing the Lumma Stealer malware through fake game update links. Attackers created new accounts to spam comment sections of legitimate games on Itch.io, posting templated messages that claimed to offer game updates. These messages included links to archives such as “Updated Version.zip,” which, when downloaded, contained a malicious executable designed to deploy Lumma Stealer. The campaign also leveraged a reflective Node.js loader to evade detection and increase the likelihood of successful infection. Security researchers observed that the attackers used a shotgun approach, spamming multiple games to maximize reach and exploit users unfamiliar with the platform. The malicious files were often hidden among benign files in the downloaded archive, making it harder for users to detect the threat. This campaign highlights the growing trend of threat actors targeting indie gaming communities and platforms beyond mainstream services like Steam, using social engineering and technical obfuscation to distribute credential-stealing malware.
Jun 29, 2026