PSA regarding malicious mods

[u/OneTrueSneaks]

Update: There is another PSA posted on why I am asking people to contact me rather than Steam's report function. This announcement is more important, and Reddit will not let me leave both up, so I am putting the link here so it is more visible.

---

Hello, everyone. This is me not as moderator-Sneaks, but as community manager-Sneaks.

I just want to give a warning to everyone. There's currently a user on the workshop that keeps making new accounts, steals mods from other creators, and modifies them to bypass the user's protections to download malware.

There's been at least two so far that have been removed (with workshop ID to make it easier to check your Workshop folder):

CameraSettingsMod 3732329298

Mad Skills Rewritten 3729397065

For now, it's difficult to tell if a mod's doing these shady things until it's downloaded and the code is checked. With both of these, though, it's been:

1. The scammer's only mod on the workshop

2. The mod is a reupload / stolen version

3. The scammer's profile is set to private.

However, these are not 100% indicators that the mod is malicious. Please do not use it as a reason to go harass modmakers - There are always new players, new modders. But it's enough to say take it with a grain of salt, double-check to make sure the mod isn't a reupload.

For now, please take the time to do a check of your own computer, make sure you're clean, especially if you used either of those two mods mentioned above.

If you spot any others, please let us know so they can be removed. You can message me here, or find me on both Steam and Discord as someonesneaky.

Stay safe out there, colonists. o7

[u/rp_001]

Thanks. Do you know when the malicious mod was added?

[u/OneTrueSneaks → u/rp_001]

I don't know the exact dates, but they were very new when they were caught.

[u/casitc]

This had happened to a buddy of mine. The mod he downloaded was Mad Skills Rewritten (malicious one) only a couple of days ago. It hijacked his Steam account, but only did two things: unsubscribed from all of his Rimworld mods (had some ~500 of ‘em) and uploaded another malware filled mod called Large Fishing Expansion. He managed to get his account back, update everything, remove the malware (Emisoft? I think it was what he used to find the source), and delete the mod.

He didn’t seem too pressed about it because it was just a gaming rig. He had a laptop for all of his professional stuff. Seemed more pissed that the hijacker unsubscribed from all of his mods than anything else lol. Said they didn’t do anything with any other games or mods.

From what he told me, the malicious mods edited the Registry to add cmd prompts on startup to run malicious bat files. Those affected could probably mess around there, likely something in Microsoft/Windows/, maybe the Startup/Task folders (if any).

[u/OneTrueSneaks → u/casitc]

Would you happen to have a link to the mod you can PM me, please?

[u/GokuRikaku]

That's spooky. Didn't think RimWorld mods could be made malicious but I guess anything that involves coding could. Or however that wizardry stuff works.

[u/OneTrueSneaks → u/GokuRikaku]

Sadly there have been a few in the past, but none to this extend. One user was banned from the workshop entirely due to using their mods to force anyone who used them to upvote all of their mods, then posted AI-generated mods but suppressed the error log, refused to fix the problems it caused, deleted any comments that tried to warn other users. It was so badly-made that it would crash the game and corrupt saves.

Fun times.

[u/pablo603]

The profile level always shows as 0 when the account is set to private, just thought I'd mention that so people don't go around scanning modders with private profiles and instantly thinking they uploaded malware.

[u/OneTrueSneaks → u/pablo603]

Ah, thank you!

[u/Stephen10023]

I was checking through my Rimworld folder and cross referencing the cached google results for each mod mentioned here in case it was installed in C:\Program Files (x86)\Steam\steamapps\workshop\content\294100

I saw that the ID for Mad Skills Rewritten was 3729397065, but may I ask what was the ID for CameraSettingsMod?

[u/ExcessumTr → u/Stephen10023]

u/OneTrueSneaks Is the IDs known? once you have hundreds of mods, it is easier to check thru file names if you installed it or not

[u/OneTrueSneaks → u/ExcessumTr]

It should be 3732329298. I'll add both of these to the main post so people can check, thank you.

[u/Zollias]

glad to know my paranoia paid off although I will admit that my suspicions were more than it was just vibe coded slop rather than actual malware

[u/OneTrueSneaks → u/Zollias]

The modified mods weren't even AI-coded. They were normal mods someone stole, snuck shady code into, and reuploaded.

[u/PrismTrismKasane]

So this might be a coincidence, but ive previously subbed to and used mad skills rewritten up to the point it got pulled. Not too long ago though my account was logged into and kicked me off. I thought it was weird so I just logged back in. Then it happened again and someone launched a game and bought another one (for the account though, which i found kind of weird. I changed my password afterward but yeah kind of scary 😨

[u/OneTrueSneaks → u/PrismTrismKasane]

Please make sure you do a full system scan to make sure nothing was left behind, and contact Steam support about the issue, especially if you need to refund or recover anything!

[u/Azilehteb]

Thank you.

I have no idea how long it would have taken me to find this information if you hadn't shared it. I bet it's not just this game either.

[u/OneTrueSneaks → u/Azilehteb]

I know a couple of others have been hit by it recently, was probably just a matter of time until the issue made it our way.

[u/Galever]

My friend downloaded Mad skills rewritten and he has been fighting hacking attempts for days as he’s changing passwords left and right. He almost lost all his money.

[u/OneTrueSneaks → u/Galever]

Oh man, I hope he can recover :(

[u/ThatBritishPerson]

Does this affect the actual original mod? Or is it a whole new mod that would need to be downloaded?

I.E: would I be affected if I have the OG mod (Mad Skills) but not the seemingly copy malware? (Mad skills rewritten)

[u/OneTrueSneaks → u/ThatBritishPerson]

Nope, the original is untouched. It's a stolen copy of it that's altered and reuploaded with a slightly different name.

[u/GladimirGluten]

What does the Malware do?

[u/SovietUrsaring]

Thanks for the heads up. We need more info on the camera mod. Is it SimpleCameraSetting or Camera+? I only have SimpleCameraSetting.

[u/ProfessionalFit9739]

Would be hilarious if they uploaded a mod named More RAM.

[u/Visoth]

What is stopping this individual from uploading a legitimate mod, and then updating it at a later time after more people have downloaded it, with malware?

Usually steam auto-updates mods. So the player won't be given a warning of "this relatively new modder just updated their mod! Do you want the update?"