Steam hack puts malware in users’ installed games

Multiple developers on Steam found that their games had malware inserted into them by hackers. The attack saw nearly a hundred users affected due to having the games installed, forcing Valve to implement security measures.

According to Simon Carless, founder of the GameDiscoverCo newsletter, hackers had found a way into the accounts of a number of game developers on Steam. This allowed them to insert malware into said developers’ games, infecting the computers of users who had them installed.

Despite the attack, Valve claims that less than 100 Steam users were affected by the malware. The company has since notified the affected users of the risk by email.

Beyond this, Valve is also taking a major step to prevent a similar attack from happening in the future. From October 24, 2023, onwards, game developers will now be required to pass a two-factor authentication check before they’ll be allowed to update the default branch of a released game on Steam. This is the branch that Steam automatically updates on players’ computers when the game is installed—any malware that finds its way into this branch automatically gets installed on users’ devices. (Read: Here’s what you need to know about Valve’s Steam Deck)

Valve added that an SMS message will be the only way to receive the two-factor code. As such, Steam partners must register a mobile phone number to be able to update their games.

Talking to PC Gamer, a Valve spokesperson stated that the “extra friction” for developers was a necessary evil to keep Steam users safe from malware, while also keeping developers aware of any attempts to hack their accounts.

In addition, Valve noted that the company has seen “an uptick in sophisticated attacks” looking to compromise the accounts of developers releasing games on Steam.

Beyond this, Valve states that it will add two-factor authentication to other back-end actions on Steam in the future.

If you like reading our content, why not show your appreciation by treating us to a cup of coffee? (or two, if you’re feeling generous)