PirateFi Game on Steam Delivered Vidar Infostealer in Elaborate Crypto-Targeted Attack

Steam, the world’s largest PC gaming platform, is scrambling to contain fallout after a malicious free-to-play game, PirateFi, was found distributing the notorious Vidar infostealer malware to unsuspecting users. The incident highlights alarming gaps in digital storefront security and underscores the growing sophistication of threat actors targeting gaming communities.

Malware Hidden in Plain Sight

Disguised as a charming survival game featuring pirate-themed base-building and crafting mechanics, PirateFi was uploaded to Steam on February 6 by a developer account named Seaworth Interactive. The game amassed positive reviews during its brief tenure, with players praising its “low-poly aesthetic” and “addictive gameplay.” However, behind the innocuous facade lurked a dangerous payload.

Steam removed PirateFi on February 12 after detecting malware in its build files. The platform has since issued urgent warnings to ~1,500 potentially impacted users, advising them to “consider reinstalling Windows” and perform full antivirus scans. Affected players reported antivirus alerts upon launching the game, with traces of malicious activity traced to a file named `Pirate.exe`.

Vidar’s Stealthy Infiltration

According to malware analyst Marius Genheimer of SECUINFRA Falcon Team, the attack leveraged a multi-stage deployment process:

InnoSetup Installer Obfuscation: The game’s installer used InnoSetup, a legitimate tool often abused to bundle malicious payloads. The malware (`Howard.exe`) was embedded within the installer, evading initial detection.
Vidar Infostealer Payload: Dynamic analysis confirmed the payload as Vidar, a malware strain notorious for harvesting browser credentials, cryptocurrency wallet data, and session cookies.
Adaptive Command-and-Control (C2): Genheimer noted the attacker frequently rotated C2 servers and employed obfuscation techniques to bypass network-level defenses.

_“The threat actor clearly targeted users interested in blockchain or crypto,”_ Genheimer stated, pointing to PirateFi’s branding as a deliberate lure for victims with high-value digital assets.

Steam’s Response Falls Short

While Steam’s notification urged users to wipe their OS and reset passwords, critics argue the platform’s safeguards remain inadequate. Despite 2023 updates like SMS-based verification for developer accounts, attackers still infiltrated the storefront.

_“This incident reveals systemic flaws,”_ said cybersecurity researcher Emily Parker. _“Steam must implement stricter vetting for new developers and real-time malware analysis for uploads.”_

Immediate Action Required

SECUINFRA warns that Vidar’s data theft capabilities leave victims vulnerable to:

Account Takeovers: Stolen browser cookies enable session hijacking, even without passwords.
Cryptocurrency Theft: Wallet credentials and private keys are prime targets.
Identity Fraud: Harvested emails and passwords often resold on dark web markets.

Recommended Mitigations:

Format infected devices and reinstall Windows.
Reset all passwords and enable multi-factor authentication (MFA).
Scan systems with tools like Malwarebytes or HitmanPro.
Monitor financial and crypto accounts for suspicious activity.

Recurring Threat

This isn’t Steam’s first malware incident. In 2023, malicious Dota 2 mods exploited a Chrome zero-day to execute remote code, while compromised Slay the Spire mods delivered the Epsilon infostealer. Despite Steam’s dominance, its open modding ecosystem and developer accessibility make it a ripe target for threat actors.

Broader Implications

The PirateFi incident underscores critical challenges for digital platforms:

Legitimate Tools, Malicious Use: Attackers increasingly weaponize trusted software like InnoSetup.
Social Engineering Tactics: Themed lures (e.g., crypto, blockchain) exploit niche communities.
Post-Infection Realities: Password resets and OS reinstalls remain burdensome yet necessary.

As Steam investigates how Seaworth Interactive bypassed safeguards, users are reminded: Free games often come at a hidden cost.

Update (February 15): Steam has temporarily suspended all new game submissions for review. The PirateFi developer account remains banned, and Valve is coordinating with law enforcement.

For technical indicators of compromise (IOCs) and YARA rules, visit SECUINFRA’s advisory [here].

— Reported in collaboration with BleepingComputer and SteamDB.

PirateFi Game on Steam Delivered Vidar Infostealer in Elaborate Crypto-Targeted Attack

Related threat feeds

Fake Google and Cloudflare Verification Pages Are Now a Seven Malware Delivery Pipeline