10 Times Malware Hid in Official Video Games

The common advice to “only buy games from official stores” isn’t always a guarantee of safety. As these cases show, malware has found its way into games through developer overreach, hacked accounts, rogue employees, and even accidental infection.

---

The Cases of Hidden Malware

Here are the 10 instances where malware was distributed through official or seemingly legitimate game channels:

1. Guild Wars 2 (2018): Developer ArenaNet intentionally added spyware to an update to scan players’ computers for cheating programs, banning 1,600 players but sparking a major privacy backlash.

2. Microsoft Flight Simulator (A320 Add-on, 2018): Flight Sim Labs admitted to intentionally adding malware to its official DLC to target a specific software pirate. The malware stole Chrome passwords.

3. Atelier Marie & Elie (Dreamcast, 2001): An accidental infection. The master game disc was burned from a PC infected with the “Kris” virus, which could delete a computer’s BIOS. The virus was harmless to the Dreamcast but affected PCs via bonus content on the disc.

4. Minecraft (2018): Hackers exploited the official skin upload system, hiding a PowerShell script inside PNG files. The script, when activated, would reformat hard drives and delete backups. Around 50,000 players were affected.

5. Garry’s Mod (2022): A rogue add-on developer updated the popular “Glue Library” mod to include loud screams and NSFW jumpscare images, which then spread to other mods that depended on it.

6. PirateFi (2023): A supposedly free-to-play game on Steam was, in fact, a front for “Trojan.Win32.Lazzzy.gen,” designed to steal browser cookies and login credentials. It was quickly removed by Valve.

7. Chemia (2024): A hacker known as “EncryptHub” injected HijackLoader and Fickle Stealer malware into the files of this Early Access survival game to steal data and maintain persistence on victims’ computers.

8. BlockBlasters (2025): In a severe case, the developer Genesis Interactive pushed a malicious update that added stealers (Trojan Stealer, VBS Loaders) to the game. It stole over $150,000 in cryptocurrency, including over $31,000 from a streamer raising money for cancer treatment.

9. Dynostopia (2014): A Steam Greenlight game that, when run, hijacked webcams, took over Steam accounts to leave fake positive reviews, and in some cases, locked users out of their PCs or deleted their data.

10. ESEA League Client (2013): A rogue employee at the e-sports platform added a Bitcoin miner to the official “Counter-Strike: Global Offensive” anti-cheat client, using users’ computers without their knowledge to mine cryptocurrency.

Key Takeaways and How to Protect Yourself

• The Threat is Real: Malware can come from developers, hackers, or even accidental sources, and official stores are not immune.

• Common Malware Goals: The primary aims are data theft (passwords, cookies, crypto), resource hijacking (cryptomining), and creating backdoors.

• Protection Strategies:

  • Use a Reputable Antivirus: This is your first line of defense and can catch many of these threats.

  • Be Wary of Early Access/Unknown Developers: Research the developer before buying.

  • Monitor Your System: Unexplained slowdowns or network activity can be a red flag.

  • Be Cautious with Mods: Only download mods from trusted sources and be mindful of dependencies.

  • Practice Good Password Hygiene: Use a password manager and enable two-factor authentication (2FA) on all accounts, especially gaming platforms like Steam.

This list serves as a stark reminder that in the digital world, vigilance is always necessary, even when you think you’re on safe ground.