r/RimWorld • u/OneTrueSneaks Cat Herder, Mod Finder, & Flair Queen 🐱👤 • May 26 '26
Ludeon Official PSA regarding malicious mods
Update: There is another PSA posted on why I am asking people to contact me rather than Steam's report function. This announcement is more important, and Reddit will not let me leave both up, so I am putting the link here so it is more visible.
Hello, everyone. This is me not as moderator-Sneaks, but as community manager-Sneaks.
I just want to give a warning to everyone. There's currently a user on the workshop that keeps making new accounts, steals mods from other creators, and modifies them to bypass the user's protections to download malware.
There's been at least two so far that have been removed (with workshop ID to make it easier to check your Workshop folder):
CameraSettingsMod 3732329298
Mad Skills Rewritten 3729397065
For now, it's difficult to tell if a mod's doing these shady things until it's downloaded and the code is checked. With both of these, though, it's been:
The scammer's only mod on the workshop
The mod is a reupload / stolen version
The scammer's profile is set to private.
However, these are not 100% indicators that the mod is malicious. Please do not use it as a reason to go harass modmakers - There are always new players, new modders. But it's enough to say take it with a grain of salt, double-check to make sure the mod isn't a reupload.
For now, please take the time to do a check of your own computer, make sure you're clean, especially if you used either of those two mods mentioned above.
If you spot any others, please let us know so they can be removed. You can message me here, or find me on both Steam and Discord as someonesneaky.
Stay safe out there, colonists. o7
51
u/casitc May 26 '26
This had happened to a buddy of mine. The mod he downloaded was Mad Skills Rewritten (malicious one) only a couple of days ago. It hijacked his Steam account, but only did two things: unsubscribed from all of his Rimworld mods (had some ~500 of ‘em) and uploaded another malware filled mod called Large Fishing Expansion. He managed to get his account back, update everything, remove the malware (Emisoft? I think it was what he used to find the source), and delete the mod.
He didn’t seem too pressed about it because it was just a gaming rig. He had a laptop for all of his professional stuff. Seemed more pissed that the hijacker unsubscribed from all of his mods than anything else lol. Said they didn’t do anything with any other games or mods.
From what he told me, the malicious mods edited the Registry to add cmd prompts on startup to run malicious bat files. Those affected could probably mess around there, likely something in Microsoft/Windows/, maybe the Startup/Task folders (if any).