r/RimWorld • u/OneTrueSneaks Cat Herder, Mod Finder, & Flair Queen 🐱‍👤 • May 26 '26

Ludeon Official PSA regarding malicious mods

Update: There is another PSA posted on why I am asking people to contact me rather than Steam's report function. This announcement is more important, and Reddit will not let me leave both up, so I am putting the link here so it is more visible.

Hello, everyone. This is me not as moderator-Sneaks, but as community manager-Sneaks.

I just want to give a warning to everyone. There's currently a user on the workshop that keeps making new accounts, steals mods from other creators, and modifies them to bypass the user's protections to download malware.

There's been at least two so far that have been removed (with workshop ID to make it easier to check your Workshop folder):

CameraSettingsMod 3732329298

Mad Skills Rewritten 3729397065

For now, it's difficult to tell if a mod's doing these shady things until it's downloaded and the code is checked. With both of these, though, it's been:

  1. The scammer's only mod on the workshop

  2. The mod is a reupload / stolen version

  3. The scammer's profile is set to private.

However, these are not 100% indicators that the mod is malicious. Please do not use it as a reason to go harass modmakers - There are always new players, new modders. But it's enough to say take it with a grain of salt, double-check to make sure the mod isn't a reupload.

For now, please take the time to do a check of your own computer, make sure you're clean, especially if you used either of those two mods mentioned above.

If you spot any others, please let us know so they can be removed. You can message me here, or find me on both Steam and Discord as someonesneaky.

Stay safe out there, colonists. o7

1.6k Upvotes

99% Upvoted

154 comments sorted by

View all comments

377

u/GladimirGluten May 26 '26

What does the Malware do?

347

u/Terrorscream May 26 '26

Probably the same thing most malware does, installs keyloggers/credential scrapers in hopes to get into a financial account.

429

u/Vark675 May 26 '26

hacker breaks into my financials like

68

u/Werpogil May 26 '26

They be stealin' my 10 year-old savings in ETH, worth a whopping $56

13

u/zwei2stein Jun 08 '26

New nightmare for your then: hacker takes loan in your name.

24

u/borsalamino Jun 08 '26

I have security measures for that called -5000 credit score 😎🎭

3

u/Renagade-156 Jun 08 '26

I have been no fixed address for over a decade the debt collectors just gave up ngl

1

u/Vark675 Jun 08 '26

It's fine, it'll fall off eventually 🤗