(Photo by Ahmet Serdar Eser/Anadolu via Getty Images)
A PC game on Valve's Steam store has been discovered distributing malware and stealing users’ cryptocurrency, draining an estimated $150,000.
BlockBlasters was released on July 30 as a 2D action title. But this past weekend, users noticed the title was secretly installing malware on their PCs that could hijack cryptocurrency wallets.
(Credit: Valve/Internet Archive)The threat played out in real time as a live streamer reacted to the malware draining $32,000 in cryptocurrency from a fund to cover their cancer treatment. A group of security researchers has since investigated and found that the malware infected as many as 261 users.
ZachXBT, an anonymous cryptocurrency researcher well-known for exposing scams, added that the malware appeared to steal over $150,000 from victims.
The attack worked by essentially using BlockBlasters as a Trojan horse, which was updated starting on Aug. 30 with malware files. To entice users to download the game, the hacker apparently messaged cryptocurrency holders to try out BlockBlasters as a paid promotion, according to the malware library organization Vx Underground.
Once the game is downloaded, the malware collects information from the user’s PC, including browser extensions and cryptocurrency wallet details.
Valve didn’t immediately respond to a request for comment. But the Steam store has delisted BlockBlasters. However, a researcher for the cybersecurity vendor G Data says it flagged BlockBlasters as a threat to Valve a week ago.
The good news is that security researchers say they’ve uncovered “mountains of technical evidence” linking the malware to the hacker. This includes communication with the hacker, who was using the messaging app Telegram.
The live streamer who lost their cancer fund treatment to the malware has since been compensated through other donations. Still, the incident is at least the fourth case of malware being spotted on the Steam store through little-known games, which is raising questions about Valve’s vetting. The threat seems to emerge if a released game is later updated with malware, and it's unclear if Valve runs any antivirus scans.