Loading story…
A malicious patch for the Steam game BlockBlasters deployed on August 30, 2025, delivered information-stealing malware and a backdoor to users' systems. The attack leveraged password-protected archives and scripts to evade detection, exfiltrate credentials, crypto wallet data, and browser information, and bypass Microsoft Defender. The game was subsequently flagged as suspicious and removed from Steam, but not before affecting hundreds of users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
SteamDB marked BlockBlasters as suspicious, and the game was removed from Steam shortly before the public write-up was published.
Telemetry cited in the reporting showed the game had more than 100 downloads after the malicious patch, with a small active player count suggesting that hundreds of systems may have been exposed.
Analysis found the infected game collecting victim IP and location data, enumerating antivirus products, stealing Steam session data, browser extension data, and cryptocurrency wallet information, then exfiltrating it to attacker-controlled infrastructure. The malware chain also added Microsoft Defender exclusions, deployed a Python-compiled backdoor, and dropped a StealC-based stealer.
A patch for the Steam game BlockBlasters, identified as Build 19799326, was released and introduced malicious scripts and payload delivery behavior consistent with an infostealer and backdoor campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
gdatasoftware.com
Open sourcemalwarebytes.com
Open sourcethecyberthrone.in
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A verified Steam game, Block Blasters, was weaponized with a cryptodrainer component, resulting in the theft of over $150,000 in cryptocurrency from hundreds of users. The attack specifically targeted individuals identified as holding significant crypto assets, with credentials and wallet information exfiltrated via a batch script and Python backdoor. Victims are advised to reset Steam passwords and move digital assets to new wallets immediately.
Jun 29, 2026
The **FBI** is seeking victims as it investigates a suspected cybercriminal who published multiple **malware-tainted games** on **Steam**, using seemingly legitimate titles as Trojan horses to infect players' systems. The games named by the agency include **BlockBlasters/BlockBasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova**, and were reportedly available between **2024 and 2026**. Both reports indicate the titles were functional enough to appear legitimate, but were designed to deliver malware and compromise users after installation. The reported impact includes **account compromise, information theft, and crypto-wallet draining**, with one cited case involving the theft of **$32,000 in cancer donations** from a streamer after exposure to one of the malicious games. The investigation suggests the listed titles may have been developed by the **same threat actor**, and that the number of affected users remains unknown. The case also highlights ongoing weaknesses in marketplace screening, as malicious games were able to reach Steam users before being removed by **Valve**.
Jun 29, 2026
Researchers reported that **BloodyStealer**, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including **Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld**, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems. The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as **KeyBase** and **Agent Tesla**, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Aug 15, 2026