Loading story…
A verified Steam game, Block Blasters, was weaponized with a cryptodrainer component, resulting in the theft of over $150,000 in cryptocurrency from hundreds of users. The attack specifically targeted individuals identified as holding significant crypto assets, with credentials and wallet information exfiltrated via a batch script and Python backdoor. Victims are advised to reset Steam passwords and move digital assets to new wallets immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage explicitly connected the Stellantis incident to the broader ShinyHunters campaign targeting Salesforce environments. This added attribution and clarified the likely intrusion path through a compromised third-party service provider.
Stellantis confirmed that customer data was compromised in the incident, with reports indicating exposure of information related to Jeep, Dodge, and other North American vehicle buyers. Multiple outlets described the breach as affecting millions of records or customers.
Stellantis disclosed it was investigating a cyber incident involving unauthorized access linked to a third-party provider. Early reports said the company was assessing the scope and impact on customer information across its brands.
A compromise of a third-party provider's Salesforce environment exposed Stellantis customer data, with later reporting attributing the intrusion to the ShinyHunters threat actor. The breach affected Stellantis data held by the external vendor rather than Stellantis' own core systems.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethecyberthrone.in
Open sourcego.theregister.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcehackread.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious patch for the Steam game BlockBlasters deployed on August 30, 2025, delivered information-stealing malware and a backdoor to users' systems. The attack leveraged password-protected archives and scripts to evade detection, exfiltrate credentials, crypto wallet data, and browser information, and bypass Microsoft Defender. The game was subsequently flagged as suspicious and removed from Steam, but not before affecting hundreds of users.
Jun 29, 2026
Researchers reported that **BloodyStealer**, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including **Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld**, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems. The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as **KeyBase** and **Agent Tesla**, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Aug 15, 2026
The **FBI** is seeking victims as it investigates a suspected cybercriminal who published multiple **malware-tainted games** on **Steam**, using seemingly legitimate titles as Trojan horses to infect players' systems. The games named by the agency include **BlockBlasters/BlockBasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova**, and were reportedly available between **2024 and 2026**. Both reports indicate the titles were functional enough to appear legitimate, but were designed to deliver malware and compromise users after installation. The reported impact includes **account compromise, information theft, and crypto-wallet draining**, with one cited case involving the theft of **$32,000 in cancer donations** from a streamer after exposure to one of the malicious games. The investigation suggests the listed titles may have been developed by the **same threat actor**, and that the number of affected users remains unknown. The case also highlights ongoing weaknesses in marketplace screening, as malicious games were able to reach Steam users before being removed by **Valve**.
Jun 29, 2026