Steam pulls recreation demo infecting Home windows with info-stealing malware

Valve has faraway from its Steam retailer the sport title ‘Sniper: Phantom’s Decision’ following a number of customers reporting that the demo installer contaminated their methods with data stealing malware.

The sport, revealed underneath the developer identify ‘Sierra Six Studios,’ was speculated to be an early preview of the title with a launch deliberate within the coming months.

Earlier than the title was pulled out, the builders on Wednesday warned gamers about downloading the sport from web sites/hyperlinks exterior Steam due to potential safety dangers. Nevertheless, getting the model from Steam additionally got here with safety threats.

Gamers suspected one thing was off with the sport after noticing that property and descriptions had been copied from different titles. Moreover, they have been prompted to obtain the demo installer from an exterior GitHub repository as an alternative of the Steam platform.

The suspicious title on Steam
Supply: Web Archive

Analyzing the installer file, Reddit customers observed that it was named ‘Home windows Defender SmartScreen.exe’ and found commodity assault instruments resembling a privilege escalation utility, a Node.js wrapper, and the instrument ‘Fiddler,’ which might intercept cookies.

The malware additionally executes a sequence of Node.js scripts and kills them rapidly to evade detection, and even runs a script named ‘createShortcut. vbs’ for persistence by including a startup job for the executable.

One other indication that the sport was really malicious is that the identical developer profile on GitHub, ‘arda1337,’ hosts crypto instruments and Telegram bot toolkits.

GitHub was fast to take away the malicious repository following consumer reviews, and yesterday Valve additionally deleted the sport from Steam.

Following the reviews and the motion taken by the 2 platforms, the developer’s web site at ‘sierrasixstudios(.)dev’ has been taken offline.

Customers that put in the sport have doubtless contaminated their computer systems with malware and are really helpful to uninstall the title and run a full system scan to take away remaining malicious recordsdata.

This incident comes solely a month after Steam hosted the PirateFi title, which was used to distribute the Vidar infostealing malware. Statistics confirmed that the sport had been dowloaded by as much as 1,500 customers.

BleepingComputer has contacted Steam for extra particulars about ‘Sniper: Phantom’s Decision’ listed on the platform however a remark wasn’t instantly accessible.

Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and the way to defend in opposition to them.

Learn the Crimson Report 2025

Supply hyperlink