smog home

Flagged releases

Game releases, mods and fake game repositories that smog's screening flagged, or that security researchers have publicly documented as malicious. None of them are listed on smog. If you come across one of these files somewhere else, do not run it.

  1. Confirmed malware

    WeedHack Minecraft malware-as-a-service campaign

    Documented in public security research (sources below). Listed on smog on .

    McAfee reported 3,820+ trojanized Minecraft mod/client/cheat JARs across 240+ distribution URLs (YouTube videos, SEO-poisoned fake sites for Meteor, Wurst, LiquidBounce, Phobos, Salhack, and a fake Skytils site). Free tier steals Minecraft sessions, browser, wallet, Discord, Steam and Telegram data; paid tier adds RAT features. About 116,464 infections since Jan 2026. Affected: Fake sites impersonating Minecraft clients/cheats (Meteor, Wurst, LiquidBounce, Phobos, Salhack, Skytils), Trojanized JARs hosted on file-hosting sites including GitHub

    Evidence

    • McAfee Public analysis/report (2026-06-02): https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/
    • BleepingComputer Public analysis/report (2026-06-02): https://bleepingcomputer.com/news/security/over-116-000-minecraft-systems-infected-in-weedhack-malware-campaign
    • Help Net Security Public analysis/report (2026-06-02): https://www.helpnetsecurity.com/2026/06/03/weedhack-minecraft-malware-campaign/

  2. Confirmed malware

    Vidar Stealer 2.0 via fake game cheats and ban-bypass tools (GitHub, Reddit)

    Documented in public security research (sources below). Listed on smog on .

    Acronis TRU found hundreds of fake free-cheat and HWID-spoofer repos, plus Reddit-promoted Counter-Strike 2 cheat sites, delivering a PowerShell/.NET loader and Themida-packed Vidar 2.0. It stole browser, wallet, Azure, SSH/FTP and messaging data, with C2 hidden in Telegram and Steam profiles. Affected: TempSpoofer.exe, Monotone.exe, CFXBypass.exe, EzFrags_Private.zip, background.exe, Perfume.mdb, scheduled task SystemBackgroundUpdate, Telegram DDR handles: bul33bt, cego54, ahnadar, Steam profile IDs: 76561198765046918, 76561198761022496, 76561198780411257

    Evidence

    • Acronis Public analysis/report (2026-03-17): https://www.acronis.com/en/tru/posts/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit/
    • infosecurity-magazine.com Public analysis/report (2026-03-17): https://infosecurity-magazine.com/news/vidar-stealer-exploits-github

    SHA-256 of flagged files

    • 2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d
    • b1cebd305c6aa27048a3673e70f8e1604735b2c06c83452d2935c330b5a3eb58
    • b6192c05029c8905fcbb88469d712dfdeaf1feb33b0690f8539373f19b6cbf85
    • fa7eafa65996c325faf2d77cc2d80179daa9228b3c138d2d3365280c79e30820
    • cbf2218ce316134795c75691f17dfaf02071ff5c369049fbf11ed072cf2103ab
    • c5e7fab18baee4a6b092e566414f4d2df1afbde35a1d12f518113054f144853f
    • 4a090e26e285661730dfd0911856c830bd0a44e639237178476ccb4993d7974f
    • e1979c42cb9e72ba9f9fcae7364887df1edcad38128feefdc3adbc768c51da05
    • d1721c9adcfa3d16bb4907afccfae64517e6c58a7c6ef058c9f5f543f60240c9
    • d1258b4c2b9849833651d1e844d1a99a5bc7febbb751548f960e92525afe6c26
    • bfee57d9e1b68c5c5aa63792b4e67b94f3361749e186531bd01609d9382672f3
    • 496d15810c25136955dd9aed6d018519380ee431f28c1bca715da59fe1385d12

  3. Confirmed malware

    SmartLoader/Lumma via fake GitHub repos (game cheats, mods, cracks) with AI-generated READMEs

    Documented in public security research (sources below). Listed on smog on .

    Trend Micro described fake GitHub repos with AI-written READMEs and Releases ZIPs (Release.zip, Software.zip) luring users with game cheats, mods, cracked software and tools. A LuaJIT-based SmartLoader fetched LummaStealer, which took browser, wallet and 2FA data. Affected: Release.zip, Software.zip, luajit.exe, lua51.dll, userdata.txt, Launcher.bat, search.exe (Lumma), C2: pasteflawwed[.]world

    Evidence

    • Trend Micro Public analysis/report (2025-03-11): https://www.trendmicro.com/en/research/25/c/ai-assisted-fake-github-repositories.html

  4. Confirmed malware

    Stealka stealer in fake game mods, cheats and cracks (incl. Roblox mod on SourceForge)

    Documented in public security research (sources below). Listed on smog on .

    Kaspersky found in Nov 2025 an infostealer spread as game cheats, mods and cracks via GitHub, SourceForge, Softpedia and fake sites. It takes browser data, 115 crypto/2FA/password-manager extensions, about 80 wallet apps, gaming clients and screenshots, and can install a miner. Affected: Roblox mod on SourceForge (name not published), Pirated Microsoft Visio crack on GitHub

    Evidence

    • kaspersky.com Public analysis/report (2025-12-18): https://www.kaspersky.com/blog/windows-stealer-stealka/55058
    • decrypt.co Public analysis/report (2025-12-18): https://decrypt.co/353072/new-malware-poses-as-roblox-mods-to-steal-crypto-credentials

  5. Confirmed malware

    Stargazers Ghost Network fake Minecraft mods/cheats on GitHub (Oringo, Taunahi, others)

    Documented in public security research (sources below). Listed on smog on .

    Check Point tracked a distribution-as-a-service network of GitHub repos (boosted by fake stars) offering fake Minecraft cheat/mod tools. A Java loader fetched a second-stage Java stealer then a .NET stealer that took browser, wallet, VPN, Discord, Telegram and Minecraft launcher data. Roughly 500 repos flagged and 1,500+ infections reported. Affected: github.com/A1phaD3v/Oringo-Client, github.com/AlphaPigeonDev/Polar-Client, github.com/AlphaPigeonDev/Skyblock-Extras, github.com/P1geonD3v/Funny-Map-Extras, github.com/P1geonD3v/Taunahi-V3, FunnyMap-0.7.5.jar, Oringo-1.8.9.jar, Oringo-Client.1.8.9.jar, Polar-1.8.9.jar, PolarClient-v2.6.jar, SkyblockExtras-1.8.9.jar, Taunahi-V3.jar, TaunahiPlus-V3.jar, MixinLoader-v2.4.jar (stage 2)

    Evidence

    • Check Point Public analysis/report (2025-06-18): https://research.checkpoint.com/2025/minecraft-mod-malware-stargazers/
    • CyberInsider Public analysis/report (2025-06-18): https://cyberinsider.com/fake-minecraft-mods-deliver-data-stealing-malware-to-players/

    SHA-256 of flagged files

    • 05b143fd7061bdd317bd42c373c5352bec351a44fa849ded58236013126d2963
    • 9ca41431df9445535b96a45529fce9f9a8b7f26c08ac8989a57787462da3342f
    • c5936514e05e8b1327f0df393f4d311afd080e5467062151951e94bbd7519703
    • 9a678140ce41bdd8c02065908ee85935e8d01e2530069df42856a1d6c902bae1
    • 4c8a6ad89c4218507e27ad6ef4ddadb6b507020c74691d02b986a252fb5dc612
    • 51e423e8ab1eb49691d8500983f601989286f0552f444f342245197b74bc6fcf
    • 5d80105913e42efe58f4c325ac9b7c89857cc67e1dcab9d99f865a28ef084b37
    • 97df45c790994bbe7ac1a2cf83d42791c9d832fa21b99c867f5b329e0cc63f64
    • 4c944b07832d5c29e7b499d9dd17a3d71f0fd918ab68694d110cbb8523b8af49
    • 5590eaa4f11a6ed4351bc983e47d9dfd91245b89f3108bfd8b7f86e40d00b9fa
    • 7aefd6442b09e37aa287400825f81b2ff896b9733328814fb7233978b104127f
    • 886a694ee4be77242f501b20d37395e1a8a7a8f734f460cae269eb1309c5b196
    • a1dc479898f0798e40f63b9c1a7ee4649357abdc757c53d4a81448a5eea9169f
    • a427eeb8eed4585f2d51b62528b8b4920e72002ab62eb6fc19289ebc2fba5660
    • f08086257c74b1de394bf150ad8aacc99ca5de57b4baa0974bc1b59bb973d355

  6. Confirmed malware

    Sniper: Phantom's Resolution (Steam demo installer)

    Documented in public security research (sources below). Listed on smog on .

    Early-access shooter whose demo installer was hosted in an external GitHub repository and acted as an infostealer; Valve removed the game and GitHub removed the repo. It dropped Node.js scripts, a privilege escalation tool and Fiddler, and set up persistence. Affected: Developer name: Sierra Six Studios, GitHub profile: arda1337, sierrasixstudios[.]dev, Windows Defender SmartScreen.exe, createShortcut.vbs

    Evidence

    • BleepingComputer Public analysis/report (2025-03-21): https://www.bleepingcomputer.com/news/security/steam-pulls-game-demo-infecting-windows-with-info-stealing-malware/
    • techcrunch.com Public analysis/report (2025-03-21): https://techcrunch.com/2025/03/21/valve-removes-video-game-demo-suspected-of-being-malware

  7. Confirmed malware

    RenEngine: HijackLoader/Lumma/ACR Stealer via pirated games with a modified Ren'Py launcher

    Documented in public security research (sources below). Listed on smog on .

    Kaspersky described pirated games (including a fake visual novel) shipping a modified Ren'Py-based launcher whose Python scripts faked a game load, sandbox-checked, and decrypted a payload. HijackLoader then injected Lumma (2025) or ACR Stealer (ongoing) into explorer.exe. Affected: setup_game_8246.zip, __init__.py, cc32290mt.dll, DKsyVGUJ.exe, hentakugames[.]com/country-bumpkin/, dodi-repacks[.]site, gamesleech[.]com

    Evidence

    • Kaspersky Public analysis/report (2026-02-11): https://securelist.com/renengine-campaign-with-hijackloader-lumma-and-acr-stealer/118891/

  8. Confirmed malware

    PirateFi (Steam) delivering Vidar infostealer

    Documented in public security research (sources below). Listed on smog on .

    Free survival game on Steam (Feb 6 to 12, 2025) whose builds carried the Vidar infostealer; Valve pulled it and told affected users to scan and consider reformatting. The payload stole browser credentials, cookies and crypto wallet data. Affected: Steam app 3476470 (PirateFi), Pirate.exe, Howard.exe (InnoSetup payload)

    Evidence

    • techcrunch.com Public analysis/report (2025-02-13): https://techcrunch.com/2025/02/13/valve-removes-steam-game-that-contained-malware/
    • BleepingComputer Public analysis/report (2025-02-13): https://www.bleepingcomputer.com/news/security/malicious-piratefi-game-infects-steam-users-with-vidar-malware/
    • secuinfra.com Public analysis/report (2025-02-13): https://www.secuinfra.com/en/techtalk/infostealer-malware-vidar-spread-via-the-steam-store/

    Affected sources

    • Download https://store.steampowered.com/app/3476470/

  9. Confirmed malware

    People Playground Steam Workshop second malicious mod incident; Valve removed C# mods

    Documented in public security research (sources below). Listed on smog on .

    A second malicious Workshop mod (modded copies launched Sept 21, 2026) could wipe personal data and publish Discord usernames and identifying details; unverified reports also mention Steam account hijacking. Developer disabled the Workshop Sept 22, shipped a build blocking mods, and a secondary outlet says Valve deleted all C# Workshop items. Affected: Unnamed malicious Workshop mod (Reddit thread title 'FPS+++++')

    Evidence

    • dexerto.com Public analysis/report (2026-09-24): https://www.dexerto.com/gaming/steam-game-shuts-off-mods-after-malware-hijacks-accounts-and-sends-slurs-to-players-friends-3412254/
    • digitalcitizen.life Public analysis/report (2026-09-24): https://www.digitalcitizen.life/people-playground-valve-deleted-c-sharp-workshop-mods-malware/

  10. Confirmed malware

    People Playground Steam Workshop worm mod 'FPS++'

    Documented in public security research (sources below). Listed on smog on .

    A Workshop mod acted as a worm: it self-voted, re-uploaded the victim's own Workshop items, republished itself under their account, reset achievements and deleted configs, maps and contraptions. Developer disabled the Workshop Feb 1 and re-enabled it Feb 6 after a security update. Affected: Workshop item 'FPS++' (People Playground, Studio Minus)

    Evidence

    • gamingonlinux.com Public analysis/report (2026-02-09): https://www.gamingonlinux.com/2026/02/steam-game-people-playground-hit-by-malware-via-the-steam-workshop

  11. Confirmed malware

    Myth Stealer (Rust) spread via fake game sites and cracked game cheat

    Documented in public security research (sources below). Listed on smog on .

    Trellix found Myth Stealer distributed through fake gaming sites offering games to 'test' (one on Blogger) and a cracked 'DDrace' cheat on a forum. The Rust DLL showed a fake window, then stole Chromium and Firefox passwords, cookies and autofill, later adding screen capture and clipboard hijack. Affected: Fake game-testing sites, Cracked DDrace cheat posted on a forum

    Evidence

    • thehackernews.com Public analysis/report (2025-06-10): https://thehackernews.com/2025/06/rust-based-myth-stealer-malware-spread.html
    • Trellix Public analysis/report (2025-06-10): https://www.trellix.com/en-in/blogs/research/demystifying-myth-stealer-a-rust-based-infostealer/

  12. Confirmed malware

    Modrinth 'Windows Borderless' malicious mod

    Documented in public security research (sources below). Listed on smog on .

    A Modrinth project (Windows only) first published a clean version, then pushed versions that sent machine info to a Discord webhook and later stole browser and Discord credentials and tokens. Modrinth removed the project, CDN links and the authors' other projects after a user report; about 372 distinct IPs downloaded it. Affected: Modrinth project ID ZQpQzwWE (former URL https://modrinth.com/mod/windowsborderless), windowedborderless-v0.2 - 1.20.4.jar, windowedborderless-v0.3 - 1.20.4.jar, windowedborderless-v0.4 - 1.20.+.jar, windowedborderless-v0.4.1_-_1.20.+.jar

    Evidence

    • Modrinth Public analysis/report (2024-05-07): https://modrinth.com/news/article/windows-borderless-malware-disclosure/

  13. Confirmed malware

    Fake game cheat and crack repositories on GitHub delivering Lumma Stealer

    Documented in public security research (sources below). Listed on smog on .

    McAfee Labs found rotating GitHub repos offering cheats for Apex Legends, Minecraft, Counter-Strike 2, Valorant, Fortnite, Call of Duty and GTA V plus cracked software. A Loader.exe delivered Lumma Stealer, and READMEs told victims to disable antivirus first. Affected: Loader.exe, Repos frequently renamed; none listed in sources

    Evidence

    • McAfee Public analysis/report (2025-01-27): https://www.mcafee.com/blogs/other-blogs/mcafee-labs/githubs-dark-side-unveiling-malware-disguised-as-cracks-hacks-and-crypto-tools/
    • CyberInsider Public analysis/report (2025-01-27): https://cyberinsider.com/fake-game-cheats-on-github-deliver-lumma-stealer-malware/

  14. Confirmed malware

    GitVenom: fake GitHub projects including a Valorant hacking tool

    Documented in public security research (sources below). Listed on smog on .

    Kaspersky GReAT found hundreds of fake GitHub projects (Instagram automation, Telegram Bitcoin bot, Valorant hacking tool) with padded commits and AI-style READMEs. Multi-stage payloads included a Node.js stealer, AsyncRAT, Quasar and a clipboard hijacker; one attacker wallet received about 5 BTC. Affected: Second-stage host: github.com/Dipo17/battle (at time of research)

    Evidence

    • Kaspersky Public analysis/report (2025-02-24): https://securelist.com/gitvenom-campaign/115694/
    • BleepingComputer Public analysis/report (2025-02-24): https://www.bleepingcomputer.com/news/security/gitvenom-attacks-abuse-hundreds-of-github-repos-to-steal-crypto/

    SHA-256 of flagged files

    • 06d0d13a4ce73775cf94a4a4f2314490de1d5b9af12db8ba9b01cd14222a2756
    • bd44a831ecf463756e106668ac877c6b66a2c0b954d13d6f311800e75e9c6678

  15. Confirmed malware

    Fractureiser malware in CurseForge and Bukkit mods and plugins

    Documented in public security research (sources below). Listed on smog on .

    Compromised CurseForge and BukkitDev accounts pushed malicious updates to mods and plugins that spread into modpacks. The staged malware infected other JARs, swapped clipboard crypto addresses, and stole browser, Discord, Microsoft and Minecraft credentials on Windows and Linux. Affected: CurseForge: Dungeons Arise, Sky Villages, Better MC modpacks, Dungeonz, Skyblock Core, Vault Integrations, AutoBroadcast, Museum Curator Advanced, Create Infernal Expansion Plus, Bukkit: Display Entity Editor, Haven Elytra, Simple Harvesting, MCBounties, others, dl.jar, libWebGL64.jar (Windows), lib.jar (Linux), client.jar, hook.dll, NekoService / ServiceHost.exe

    Evidence

    • Bitdefender Public analysis/report (2023-06-07): https://www.bitdefender.com/en-us/blog/labs/infected-minecraft-mods-lead-to-multi-stage-multi-platform-infostealer-malware
    • BleepingComputer Public analysis/report (2023-06-07): https://www.bleepingcomputer.com/news/security/new-fractureiser-malware-used-curseforge-minecraft-mods-to-infect-windows-linux/
    • GitHub Public analysis/report (2023-06-07): https://github.com/trigram-mrp/fractureiser

  16. Confirmed malware

    FBI notice on seven or eight malware Steam games (adds Dashverse/DashFPS, Lampy, Lunara, Tokenova)

    Documented in public security research (sources below). Listed on smog on .

    FBI Seattle asked victims of malware-laden Steam games (BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, Tokenova) active May 2024 to Jan 2026 to come forward. A July 2026 complaint alleges about 8,000 infected devices and at least $220k stolen from crypto wallets, and an arrest was reported. Affected: Dashverse / DashFPS, Lampy, Lunara, Tokenova, Contact cited by BGR: [email protected]

    Evidence

    • bgr.com Public analysis/report (2026-03-16): https://bgr.com/2125332/fbi-warns-steam-games-contained-hidden-malware/
    • heise.de Public analysis/report (2026-03-16): https://www.heise.de/-11211667
    • cryptoslate.com Public analysis/report (2026-03-16): https://cryptoslate.com/crypto-malware-in-8-steam-games-stole-tokens-from-user-wallets-and-left-a-trail-to-uber-eats-deliveries/

  17. Confirmed malware

    Fake 'undetected' Xeno Roblox executor delivering Java RAT/infostealer

    Documented in public security research (sources below). Listed on smog on .

    Bitdefender documented trojanized Xeno executor archives (xeno.exe) that install a bundled JRE and a staged Java payload ending in a RAT and stealer. It steals browser, Discord, Roblox, Minecraft and Microsoft Store tokens and Exodus wallet data, with keylogging, webcam and remote shell; activity since early 2026. Affected: xeno.exe, decompiler.exe (stage 2 JAR), instance.exe, XenoIcon.jpg, solthere[.]net, persistence Run key 'Display Calibration'

    Evidence

    • Bitdefender Public analysis/report (2026-08-03): https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor
    • BleepingComputer Public analysis/report (2026-08-03): https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware/

  18. Confirmed malware

    Chemia (Steam early access) compromised by EncryptHub / Larva-208

    Documented in public security research (sources below). Listed on smog on .

    Prodaft attributed to EncryptHub a July 22, 2025 injection of HijackLoader, Vidar and Fickle Stealer into the early-access game's files. The malware ran in the background and stole browser data and crypto wallets. Affected: CVKRUTNP.exe (HijackLoader), v9d9d.exe (Vidar), cclib.dll, worker.ps1, soft-gets[.]com

    Evidence

    • PRODAFT Public analysis/report (2025-07-24): https://github.com/prodaft/malware-ioc/blob/master/LARVA-208/SteamCampaign.md
    • BleepingComputer Public analysis/report (2025-07-24): https://www.bleepingcomputer.com/news/security/hacker-sneaks-infostealer-malware-into-early-access-steam-game/

    Affected sources

    • Download https://store.steampowered.com/app/2930480/Chemia/

    SHA-256 of flagged files

    • ed076c27b420bfa66c251488b4121913fa461367a60c5fa32cee3953efcae32b
    • 6fb7fd9763d6b269793c80bbc03a1be358390781af4b698fba1591cb8dbb8825
    • 2cd8c0e75cf76381f06dfe465a542e52eefa713b0bea2557763e0c0c45b21481
    • 9a733b2de84e2bf466287abd034b04b18c8c269535606e8f6403eee2a3b288c4
    • 12935315254175719cbbaad0b213204ddebd4100ffc551d54f8cf39ced1be227

  19. Confirmed malware

    BlockBlasters (Steam) malicious patch with StealC and crypto drainer

    Documented in public security research (sources below). Listed on smog on .

    Free platformer on Steam (Jul 30 to Sep 21, 2025); build 19799326 of Aug 30 added a batch dropper, Python backdoor and StealC that harvested Steam login data, browser and wallet data. About $150k in crypto reportedly stolen from 261 accounts. Affected: Steam app 3872350 (BlockBlasters), game2.bat, Launch1.vbs, Test.vbs, 1.bat, test.bat, Client-built2.exe, Block1.exe, v1.zip, v3.zip

    Evidence

    • G DATA Public analysis/report (2025-09-22): https://blog.gdatasoftware.com/2025/09/38265-steam-blockblasters-game-downloads-malware
    • BleepingComputer Public analysis/report (2025-09-22): https://www.bleepingcomputer.com/news/security/verified-steam-game-steals-streamers-cancer-treatment-donations/

    Affected sources

    • Download https://store.steampowered.com/app/3872350/

    SHA-256 of flagged files

    • aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3
    • c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3
    • b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b
    • e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605
    • 3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0
    • 17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a
    • 59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e
    • cd817345f9e62fa8e9b66e47b645278e74f2a2cf59b8a81b88d1b2ec54b9933d
    • 58a97ab524b704172a8f68fda92daa802b706e397adede410b6475a4eb229c9b

  20. Suspicious

    BleedingPipe: RCE in popular Forge mods exploited against servers and players

    Documented in public security research (sources below). Listed on smog on .

    Unsafe Java deserialization in many 1.7.10/1.12.2 Forge mods let attackers take over servers and, via them, exploit connecting clients; one attack stole Discord and Steam session data. Not a malicious mod per se, but relevant to scanning mod catalogs for known-vulnerable versions. Affected: EnderCore <1.12.2-0.5.77, LogisticsPipes <0.10.0.71, BDLib 1.7 to 1.12, Smart Moving 1.12, Brazier, DankNull, Gadomancy, Astral Sorcery <=1.9.1, JourneyMap <1.16.5-5.7.2, Minecraft Comes Alive 1.5.2 to 1.6.4, RebornCore <4.7.3, Thaumic Tinkerer <2.3-138

    Evidence

    • BleepingComputer Public analysis/report (2023-07-31): https://www.bleepingcomputer.com/news/security/hackers-exploit-bleedingpipe-rce-to-target-minecraft-servers-players/
    • Bitdefender Public analysis/report (2023-07-31): https://www.bitdefender.com/en-us/blog/hotforsecurity/minecraft-mods-hit-by-massive-bleedingpipe-vulnerability-leaving-thousands-at-risk

  21. Confirmed malware

    Beyond The Dark (formerly Rodent Race) on Steam

    Documented in public security research (sources below). Listed on smog on .

    Free horror game whose listing was repurposed from an older puzzler starting May 4, 2026; a modified UnityPlayer.dll profiled the machine, looked for browser wallet extensions (e.g. MetaMask) and credentials, and contacted external servers. Valve delisted it after researcher Eric Parker's analysis. Affected: Steam app 3393800, UnityPlayer.dll (modified)

    Evidence

    • Bitdefender Public analysis/report (2026-05-19): https://www.bitdefender.com/en-us/blog/hotforsecurity/steam-horror-game-malware
    • pcgamesn.com Public analysis/report (2026-05-19): https://www.pcgamesn.com/steam/beyond-the-dark-malware-game
    • videogameschronicle.com Public analysis/report (2026-05-19): https://www.videogameschronicle.com/news/steam-game-replaced-crypto-malware-delisted/

    Affected sources

    • Download https://store.steampowered.com/app/3393800/