(Valve's Steam)
For the second time in two months, a hacker has used Steam to circulate malware to unsuspecting gamers. This time, the attack arrived through a demo for a game called Sniper: Phantom's Resolution.
The game advertised itself as an action-packed first-person shooter that was slated to release in this year’s second quarter. But earlier this week, a Reddit user warned that the game’s demo appeared to be a computer virus.
To avoid detection, the hacker didn’t circulate the malicious demo on Steam directly. Instead, the game’s Steam page featured a link to the developer’s external website, sierrasixstudios.dev, which contained another link to download the demo from a file-sharing site.
To trick gamers into installing the demo, people were contacted via random direct messages on Discord, says Reddit user FERAL_WASP. A further analysis of the demo shows it can intercept a PC’s network traffic and steal cookies from an internet browser to break into a victim’s online accounts.
Steam’s owner, Valve, didn’t immediately respond to a request for comment. But the Steam page for Sniper: Phantom's Resolution has since been taken down.
The incident occurs a month after a separate game called “PirateFi” was released on Steam and circulated malware to users on the platform. How PirateFi evaded Steam’s safeguards remains unclear. But to promote the game, the hacker used a bot on Telegram to advertise a paid position to gamers to act as a chat moderator for PirateFi.
While PirateFi was a fake game, evidence is emerging that Sniper: Phantom's Resolution might be a real FPS shooter under development from a team called Sierra Six Studios.
“Our team has fallen victim to a scam where someone purchased a domain in our name and set up a repository with a downloadable game that was fraudulent and contained malware,” wrote a Sierra Six Studios representative named “Andrew.”
In a Reddit post, Andrew added: “We named our developer account sierrasixstudios.dev because we planned to create a website if the game gained attention from players. However, we hadn’t purchased the domain yet, as it wasn’t a priority at the time. Unfortunately, someone scraped the name, registered the domain, and used it for malicious purposes.”
Andrew’s post also indicates the Steam page for Sniper: Phantom's Resolution was legitimate. The problem is it featured a link to sierrasixstudios.dev, which the team had yet to register. As a result, a hacker was able to swoop in, buy the domain, and host malware on a look-alike site.
“??This was a major oversight on our part. We’ve since changed the developer account name to prevent further confusion. Honestly, if we hadn’t added '.dev' at all, this situation might have been avoided, as there would have been no direct link to us,” Andrew added.