Full Report
A gamer seeking financial support for cancer treatment lost $32,000 after downloading from Steam a verified game named BlockBlasters that drained his cryptocurrency wallet. [...]
Analysis Summary
# Incident Report: Verified Steam Game Distributes Malware to Steal Cryptocurrency
## Executive Summary
A verified, free-to-play game on Steam, "BlockBlasters," was updated to include cryptodrainer and infostealer malware, leading to the compromise of numerous user accounts, including a streamer who lost $32,000 intended for cancer treatment. Attackers utilized a dropper batch script and a StealC payload to harvest Steam credentials and cryptocurrency wallet information from unsuspecting users. Response involved community efforts, security researchers documenting the malware, and subsequent advisories urging users to reset passwords.
## Incident Details
- Discovery Date: Sometime around September 21, 2025 (revealed during a live stream)
- Incident Date: Malicious component added on August 30, 2025
- Affected Organization: Various Steam users, notably streamer Raivo Plavnieks (RastalandTV)
- Sector: Gaming / Software Distribution (Steam)
- Geography: Global (affecting Steam users worldwide)
## Timeline of Events
### Initial Access
- Date/Time: August 30, 2025 (when the malicious component was added)
- Vector: Downloading/installing a verified game ("BlockBlasters") from the official Steam platform.
- Details: The developer, Genesis Interactive, updated the game to include malicious code.
### Lateral Movement
- Details: Network/system lateral movement is not explicitly detailed, but the goal was local data collection (Steam credentials, IP addresses) across compromised endpoints.
### Data Exfiltration/Impact
- Details: Compromised users had their cryptocurrency wallets drained. The identified streamer lost over $32,000 intended for treatment. Security groups reported up to $150,000 stolen from 261 accounts, with one source suggesting 478 victims.
### Detection & Response
- Detection: The compromise was publicly revealed when streamer Raivo Plavnieks noticed his funds draining during a live donation stream on September 21, 2025.
- Response Actions: Community members, including crypto influencer Alex Becker, covered the streamer's loss. Researchers documented the dropper script and StealC payload. The game was subsequently removed from Steam.
## Attack Methodology
- Initial Access: Compromise of the official Steam distribution channel via a trusted application ("BlockBlasters").
- Persistence: Not explicitly detailed, but the malware likely persisted long enough to run collection routines.
- Privilege Escalation: Not explicitly detailed.
- Defense Evasion: The dropper script performed environment checks before executing the payload, suggesting basic anti-analysis capabilities.
- Credential Access: Collection of Steam login information.
- Discovery: Reconnaissance occurred after execution, focused on locating sensitive files and wallet information.
- Lateral Movement: Not the primary focus; attacks targeted local endpoints holding cryptocurrency assets.
- Collection: A batch script collected Steam login data and IP addresses, uploading this to a C2 system. A Python backdoor and StealC malware payload were also documented in use.
- Exfiltration: Data (credentials, IP addresses) uploaded to an attacker-controlled Command and Control (C2) system.
- Impact: Financial theft via cryptocurrency wallet draining.
## Impact Assessment
- Financial: At least $150,000 estimated stolen from confirmed victims. The primary victim reported a loss of $32,000.
- Data Breach: Steam login credentials and victim IP addresses.
- Operational: Disruption to users' personal finances and trust in the Steam platform.
- Reputational: Negative scrutiny placed upon Valve/Steam for allowing a verified, malicious application onto the platform.
## Indicators of Compromise
- Network Indicators: C2 communication destination (URL/IP not specified, though data was uploaded to C2).
- File Indicators: Known dropper batch script; Python backdoor; StealC payload variant.
- Behavioral Indicators: Execution of environment-checking batch scripts followed by the execution of credential harvesting tools targeting Steam data.
## Response Actions
- Containment: The game "BlockBlasters" was removed from the Steam platform. Affected individuals were advised to immediately reset Steam passwords and move digital assets.
- Eradication: Specific documentation of malware components allowed security researchers to identify and publish details about the threat.
- Recovery Actions: The affected streamer had his $32,000 loss covered by community members.
## Lessons Learned
- Verified status on Steam does not guarantee safety; malicious code can be injected post-release.
- Developers selling or distributing free games can use legitimate channels to push major malware updates.
- Attackers showed operational security failures by leaving identifiable artifacts (Telegram bot code/tokens) exposed.
## Recommendations
- Users should exercise extreme caution with Steam games having few downloads or reviews, or those still in 'beta' stages.
- Users who installed BlockBlasters must immediately reset Steam passwords and transfer cryptocurrency holdings to new, secure wallets.
- Valve/Steam should improve vetting processes for updates pushed to verified titles, especially concerning updates containing new, functional components.