FBI Investigates Malware Hidden in Steam Games

The FBI’s Seattle Division has issued a call for victims of malicious Steam titles that secretly distributed malware between May 2024 and January 2026. The agency is gathering information to track stolen cryptocurrency, compromised accounts, and the threat actors behind the campaign.

What Happened

• Malicious titles identified: BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova.
• Attack vector: Games uploaded clean, then later updated with malware such as cryptodrainers, HijackLoader, Vidar infostealer, and custom stealers.
• Impact: Stolen credentials, hijacked accounts, and drained cryptocurrency wallets.
• Victim reports: Streamer Raivo Plavnieks lost $32,000 live on stream after downloading BlockBlasters. Investigators estimate losses of $150,000–$478,000 across hundreds of accounts.

FBI’s Focus

• Cryptocurrency theft: Victims asked to report stolen funds and suspicious transactions.
• Account hijacks: Information on compromised Steam accounts is being collected.
• Evidence gathering: Screenshots of communications with game promoters may help trace stolen crypto.
• Confidentiality: Victim identities will remain protected, with potential eligibility for restitution.

Why This Matters

• Gaming as a threat vector: Steam’s massive user base makes it a lucrative target for malware distribution.
• Trust exploited: Games initially appeared legitimate, then were weaponized through updates.
• Scale of exposure: Thousands of users may have unknowingly installed malware.
• Industry silence: Valve has not yet commented publicly on the FBI investigation.

Defensive Recommendations

• Check installed titles: If you downloaded any of the listed games, run antivirus scans and review system activity.
• Reinstall OS if needed: Steam warned some victims that malicious files may have executed, recommending full system reinstalls.
• Secure crypto wallets: Rotate keys, move funds to new wallets, and enable hardware wallet protections.
• Report to FBI: Victims should submit information to Steam_Malware@fbi.gov.

Final Thought

The Steam malware campaign shows how gaming platforms can be weaponized for large‑scale theft. With attackers blending social engineering, malware loaders, and cryptocurrency drainers, the FBI’s investigation underscores the importance of vigilance in digital entertainment. For gamers, the lesson is clear: trust but verify — even on official platforms.