While app stores tend to succumb to malware every so often, Steam’s reputation has been relatively squeaky clean. Unfortunately, that changed after a game on the storefront turned out to be a malicious app in disguise.
A Free-to-Play Pirate Game on Steam Was Malware in Disguise
As PCMag reported, a malicious actor uploaded a title called PirateFi onto the Steam platform. The PirateFi store page described the game as a sandbox pirate game that was free to play, which was likely a ploy to get as many downloads as possible.
Once people downloaded the game, it deployed a Trojan named “Trojan.Win32.Lazzzy.gen.” This malware’s main goal is to dig through browser cookies and steal login details. Once people identified PirateFi as malware, they warned Valve, which removed the game and sent out a message to anyone affected.
Unfortunately, the Trojan stuck around long enough to do some serious damage to people’s accounts. As detailed on the Steam discussion board for PirateFi, one victim saw their account compromised and used to purchase Dota 2 skins.
Another person claimed the cybercriminals hacked their Microsoft account and blocked Microsoft Support. They then accessed the victim’s Roblox account, stole $20, and sent a message to all of their friends containing a scam link.
If you want to avoid having your accounts stolen, be careful what you download from the Steam store. While Steam is usually very good at catching virus uploads, you can do your part by staying away from new releases that are free-to-play and “seem off” somehow. For example, PirateFi used stolen assets from other games in its advertising, which is a big red flag. You can also prevent Steam phishing by performing some best practices.
