@vx_underground@infosec.exchange
2026-09-25 04:38 UTC
Yeah, so I decided to check out the Steam goop people were DMing me about.
Basically there is something called People's Playground (I have no idea what that is) and they started discussing a malicious Steam mod thingie surrounding it. However, the malware is not specific to them but is a much more broad issue.
Interestingly, this is a Steam mod worm. I have never seen anything like this before. I found it very silly.
What I did not find silly, and I actually found it very ... confusing ... was the payload in all of this. Once this Steam worm thingie is detonated on your machine it
- Deletes browser cookies (???)
- Deletes photos from "MyPictures" on Windows
- Deletes videos from "MyVideos" on Windows
- Tries to "destroy" Steam friends, apps, etc
Throughout the entire payload I was looking for something else, like data exfiltration, or a broader malware campaign, ... but all this does is try to fuck up Steam, delete gunk off your computer, and then self-spreads by making the Steam user publish a mod.
Some gamer nerd guy person did a write-up on it. I'll link it. I verified everything they wrote and they're correct on it.
I just don't get it though. This guy could have had a semi-successful information stealer campaign, or pay-per-install campaign, ... or crypto theft, ... or anything. but all it does is fuck up your Steam locally.
Like, all you need to do is reinstall Steam. I don't understand.
Replies (1)
-
@vx_underground@infosec.exchange 2026-09-25 04:39
Write-up which is factually accurate and cool https://studiominus.nl/ppg-september-incident/red_analysis.html