Cyber Security News

Steam Confirms Malware Found in BlockBlasters Game

Steam has officially confirmed that malware was discovered in the popular indie game BlockBlasters.

The announcement follows widespread player reports and security scans that flagged unusual activity in the game’s files.

This incident raises concerns about game security and digital storefront safety.

Background of the Incident

BlockBlasters launched earlier this month and quickly gained attention for its colorful graphics and fast-paced gameplay.

Players praised its creative level designs and simple controls. However, on September 23, several users on social media and community forums reported that Steam’s built-in virus scanner identified malicious code in the game installation files.

These reports caught the attention of security experts, who began to investigate the game’s executable and associated libraries.

Initial community analysis suggested that the malware was embedded in a third-party plugin used by the developer to manage in-game ads.

The plugin appeared to connect to an external server without proper encryption, potentially exposing users to data theft.

Some gamers reported strange pop-ups and system slowdowns after installing the update released on September 20. As more players flagged the issue, Steam’s security team launched a formal review.

Steam’s Official Response

On September 24, Steam issued a public statement acknowledging the malware discovery. The platform temporarily removed BlockBlasters from the Steam store and disabled the game for all users.

In its notice, Steam confirmed that the malicious code was not part of the original game design but was introduced through the third-party ad management plugin.

Steam reassured players that it is working directly with the game’s developer to remove the malware and ensure a clean version of the game is available.

Steam also pledged to enhance its scanning processes for third-party components used by developers.

The platform said it will introduce additional checks for ads and external libraries to prevent similar incidents.

Steam’s security team encouraged other developers to audit any plugins or scripts that interact with player systems.

Players who have downloaded or played BlockBlasters between September 20 and 24 should take immediate action.

First, uninstall the game and delete any leftover files from the installation folder. Next, run a full antivirus scan on your system to detect and remove any remaining malicious code.

Users are advised to update all security software to the latest versions before scanning.

For extra caution, gamers should change passwords for any accounts accessed from their device during the period when the game was installed.

Enabling two-factor authentication on critical services, such as email and banking, can help protect against unauthorized access.

If you notice any unusual activity even after following these steps consider consulting a professional for deeper system checks.

Steam said the clean version of BlockBlasters will return to the store only after a thorough audit. In the meantime, players should avoid downloading unofficial patches or reuploads of the game.

Steam’s swift action highlights the importance of robust security checks for digital content and the need for ongoing vigilance by both platforms and developers.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago