Steam Game Block Blasters Steals $150K in Crypto from Players
14 hours ago
- #spearphishing
- #cryptocurrency
- #cybersecurity
- A fake Steam game named Block Blasters was used in a spearphishing campaign, stealing over $32,000 from a terminally ill cancer patient.
- The campaign made a total of $150,000 and exploited Valve's inadequate vetting of indie game uploads.
- Twitch and Steam content creator RastaLandTV, battling Stage IV Sarcoma, was victimized live while streaming the game.
- Security researchers, including Karsten Hahn of GDATA, analyzed the malware, which included multiple obfuscated payloads like game.bat, a PyInstaller backdoor, and StealC binary.
- The malware checked for antivirus processes before deploying payloads and uploaded stolen data to an unprotected server.
- Researchers accessed the command-and-control server, extracting logs for 478 victims and internal conversations mocking victims.
- Steam's inadequate checks allowed the malicious game to remain available for nearly a month.
- Similar incidents occurred with other indie games like Sniper: Phantom's Resolution and PirateFi.
- Recommendations include avoiding indie game demos without verified developer reputations and using hardware wallets for cryptocurrency storage.