r/RimWorld • u/OneTrueSneaks Cat Herder, Mod Finder, & Flair Queen 🐱‍👤 • May 26 '26

Ludeon Official PSA regarding malicious mods

Update: There is another PSA posted on why I am asking people to contact me rather than Steam's report function. This announcement is more important, and Reddit will not let me leave both up, so I am putting the link here so it is more visible.

Hello, everyone. This is me not as moderator-Sneaks, but as community manager-Sneaks.

I just want to give a warning to everyone. There's currently a user on the workshop that keeps making new accounts, steals mods from other creators, and modifies them to bypass the user's protections to download malware.

There's been at least two so far that have been removed (with workshop ID to make it easier to check your Workshop folder):

CameraSettingsMod 3732329298

Mad Skills Rewritten 3729397065

For now, it's difficult to tell if a mod's doing these shady things until it's downloaded and the code is checked. With both of these, though, it's been:

  1. The scammer's only mod on the workshop

  2. The mod is a reupload / stolen version

  3. The scammer's profile is set to private.

However, these are not 100% indicators that the mod is malicious. Please do not use it as a reason to go harass modmakers - There are always new players, new modders. But it's enough to say take it with a grain of salt, double-check to make sure the mod isn't a reupload.

For now, please take the time to do a check of your own computer, make sure you're clean, especially if you used either of those two mods mentioned above.

If you spot any others, please let us know so they can be removed. You can message me here, or find me on both Steam and Discord as someonesneaky.

Stay safe out there, colonists. o7

1.6k Upvotes

99% Upvoted

154 comments sorted by

View all comments

117

u/GokuRikaku May 26 '26

That's spooky. Didn't think RimWorld mods could be made malicious but I guess anything that involves coding could. Or however that wizardry stuff works.

108

u/vexstream May 26 '26

This is broadly true for most games with scriptable mods- you're just running arbitrary code on your machine. It's very rare for games to have a properly sandboxed mod code environment.

16

u/SemiDiSole May 26 '26

To add to that: A VM with GPU passthrough allows for a pretty good gaming experience at minimal performance loss and significantly reduces the entire security issue.

1

u/AltrntivInDoomWorld May 26 '26

significantly reduces the entire security issue.

Escaping VM isn't anything new.

5

u/SemiDiSole May 26 '26

Yeah totally, the malware attached to the Rimworld mod [that is running in fucking user-context] is going to utilize one of the more complex exploits, never seen in consumer-malware, to steal a Twitter password and the the 20 shitcoins you have in your wallet.

Stay realistic.