A game on the Steam store feels safe to install. Since 2023, Steam games and updates have repeatedly carried malware, most often infostealers: programs that copy saved passwords, browser sessions and crypto wallets, which puts a CS2 trader's signed-in Steam account at risk. In July 2026 federal authorities arrested a man accused of being behind several of them.
Steam malware games: the documented cases
Several of these cases started as clean games.
| When | Game | How it reached players | What it did |
|---|---|---|---|
| Aug–Sep 2023 | NanoWar: Cells VS Virus and others | Malicious updates pushed from hijacked developer accounts | Infected players; Valve warned those affected |
| Feb 2025 | PirateFi | A new game, on the store for about a week | Installed the Vidar infostealer |
| 2025 | Chemia | Malware added to a survival crafting game's files | Two infostealers, Vidar and Fickle Stealer |
| Jul–Sep 2025 | BlockBlasters | Launched clean on July 30; an August 30 update added the malware | Drained crypto wallets and collected Steam logins |
| Jan 2026 | Lampy | An updated version carried malware, the criminal complaint says | Named in the FBI's appeal |
| May 2026 | Beyond The Dark | A family puzzle game's listing, Rodent Race, renamed and changed | Went after crypto wallet credentials until Valve removed it |
BlockBlasters did the most visible damage. A streamer raising money for cancer treatment lost $32,000 after someone in his stream got him to download it, and blockchain investigator ZachXBT estimated that about $150,000 was taken from 261 Steam accounts in all.
The FBI case
In March 2026 the FBI's Seattle Division asked people who had installed malware-laden Steam games to come forward. Its notice names BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi and Tokenova, and says the attacker mainly targeted users between May 2024 and January 2026.
On July 14, 2026 a 21-year-old Florida man was arrested and charged with conspiracy to obtain information by computer for private financial gain. The criminal complaint alleges that he and others launched eight games embedded with malware, infected about 8,000 devices and stole at least $220,000 in crypto from about 80 wallets.
It says eight developer accounts used for the games are believed to have been opened with stolen identities of U.S. citizens, and that the group promoted the games on Discord, Telegram, X and LinkedIn. The complaint never names Steam, but every game it names is on the FBI's list. These are allegations, not findings of a court.
How the malware got past Steam's checks
Valve reviews a game's store page and build before release. After that, its developer documentation says: "there is no need to go through review again. You are free to update your game as much as you need to." BlockBlasters fits that gap: it was clean at launch on July 30, 2025, and the malware arrived in an August 30 update.
After the 2023 hijackings, Valve began requiring a confirmation code sent to the developer's phone before a new build goes live on the default branch of a released game, the version players get unless they opt into a beta. That step targets hijacked developer accounts. It does nothing against someone who controls the account from the start, which is what the complaint describes, even though the platform asks for payment details and identity documents before approving a developer account.
What an infostealer takes
The complaint lists what the group was after: "account log-in information, auto-filled data, user tokens, and cookies". Fickle Stealer, found in Chemia, takes credentials, browser data, cookies and crypto wallets, and BlockBlasters collected Steam login details.
Tokens and cookies are what keep you signed in, so a copy lets someone use your session without your password or a Steam Guard code. The NanoWar developer said the malware that hit him took the session tokens for all his accounts, and the attackers kept access until those were revoked or expired.
The trade redirection scam Valve describes, where a hijacker cancels your trade and swaps in one to a look-alike account, hoping you confirm it on your phone without checking, depends on exactly that access; the API key scam article explains it and what to check. Valve also warns that Steam-targeting malware can slip past common antivirus and wait until the Steam Wallet has money in it, and that some of it can delete itself afterwards.
How players were talked into installing
The complaint says the group urged people on social media to download the games, and used bots to find large crypto holders and send them targeted messages. BlockBlasters targets were reportedly picked out on Twitter for managing large amounts of crypto and apparently invited to try the game.
The NanoWar developer was caught the same way in 2023, by someone on Discord asking him to review their game. Valve's advice covers all of it: "Always be skeptical of software linked to you by others even if it is hosted on a platform that you'd normally trust." The guide to screen-sharing and remote-access scams covers the related "install this to play" requests.
Before you install an unknown game
No single sign is proof either way, but the cases above share a few:
- No track record. A studio with no other games and no presence outside its store page could be anyone; the accounts in the FBI case are believed to have been opened under stolen identities.
- A renamed listing, then glowing reviews. Beyond The Dark's store page belonged to Rodent Race until early May 2026, and it collected positive reviews from May 7 to 18 before players' warnings pulled its rating down to Mixed.
- Few reviews, or a beta. BleepingComputer advised caution with games that have few downloads and reviews, and with titles in beta.
Good reviews don't settle it: BlockBlasters had a few hundred, rated Very Positive overall. Read the newest reviews and discussions before installing.
If you ran one
Treat everything saved on that PC as copied. Valve's notice to PirateFi players advised an antivirus scan, a check for software you don't recognise and considering a reinstall of the operating system.
From a device you trust, follow Valve's steps for a compromised account: check Authorized Devices and use Sign out everywhere, change your Steam password, and review the security of the email account behind it. Signing out everywhere matters here, because copied session tokens keep working until they're revoked or expire. Then revoke any Steam Web API key you didn't create.
Check your Trade History too: CS2 items traded away in the last seven days can be reversed if you lost control of the account, at the cost of a 30-day trading and Market cooldown, as the trade protection guide explains. Move any crypto kept on that PC to new wallets, as BleepingComputer advised BlockBlasters players.
If the game was one of the seven the FBI named, its March notice asked victims to fill in an online form, and questions can go to [email protected]. The account security checklist covers the rest of the clean-up.
Sources
- FBI seeks victims of Steam games used to spread malware — BleepingComputer
- Criminal complaint in the Steam malware case, W.D. Washington — DocumentCloud
- Florida man arrested for allegedly stealing over $200,000 in crypto using Steam game malware — The Verge
- Verified Steam game steals streamer's cancer treatment donations — BleepingComputer
- Family-friendly Steam game is replaced by crypto malware before being delisted — VGC
- Steam enforces SMS verification to curb malware-ridden updates — BleepingComputer
- Review Process — Steamworks Documentation
- Account Security Recommendations — Steam Support
