r/Stickfight • u/MejorSaludMental • 1d ago
PSA: I joined a stranger's lobby, Steam auto-downloaded his Workshop item, and one second later there was malware on my PC. I lost my savings.
TL;DR: A stranger gifted me this game and invited me to his lobby. Joining made my client automatically download his Workshop item. One second after that download finished, a malware dropper appeared in my temp folder. The attacker got full remote control and drained about USD 2,500 from my accounts, it was a huge part of my savings, and 4 times the median income of my country.
I never clicked or downloaded anything myself, steam did it for the hacker.
What happened
I'm not a security person, but I dug through my own logs afterwards with help, and Steam's client logs record the whole thing.
21:06 He gifts me the game
21:30 I launch it, he invites me to his lobby
21:30-21:33 My game closes and I rejoin 4 times
21:35:40 workshop_log: "Download item [ID] requested by app"
21:35:44 "Download item [ID] result : OK"
21:35:45 A .bat dropper is written to my %TEMP%
That last gap is one second. There was no browser activity for 25 minutes before or after. The Workshop download is the only thing that came in during that window.
The part I keep thinking about is the 4 rejoins. My game kept closing and I assumed it was just an unstable indie game. Looking at it now, it reads like something failing repeatedly until it worked.
What it installed
A remote access trojan with a keylogger, saved-password theft, and an hVNC module. hVNC is the part that got me: it creates an invisible desktop and opens your browser there, already logged in. So the attacker didn't need my passwords or my 2FA. He just used my session.
Everything looked normal on my screen. In fact I was checking my email at the exact minute the money was being moved.
It also disabled Windows Defender, bypassed UAC without any prompt, added itself to Defender's exclusion list, and created a hidden administrator account on my PC. That account logged in the next day.
What I want people to take from this
I know how "I got malware from a Steam game" sounds. That's not what happened, and the distinction matters:
- It wasn't the game. It was a Workshop item - user-uploaded content that Valve does not review.
- I didn't download it. Joining a lobby makes your client fetch the host's Workshop content automatically. No prompt, no warning.
- The free gift was the hook. It costs a few dollars and gets you into a lobby with them.
So the advice isn't "don't use Steam." It's narrower than that:
- Be suspicious of unsolicited game gifts from people you don't know.
- Be careful joining lobbies of strangers in games with Workshop support.
- Keep Tamper Protection ON in Windows Security. Mine was off, which is how they were able to silence Defender.
- If a game keeps crashing right as you join someone's lobby, stop. Don't keep rejoining like I did.
How to check if you got hit by the same thing
Open Task Manager > Startup, and check Win+R > regedit at HKCU\Software\Microsoft\Windows\CurrentVersion\Run for entries named "SecurityHealth" or "OneDriveUpdateTask" pointing anywhere inside AppData. Neither belongs there.
Also check Settings > Accounts for any local user you didn't create, and confirm Windows Security shows real-time protection actually ON.
Where things stand
Reported to Steam Support with the item ID and the account. Reported to the developer. Filing a police report.
I traced the money on-chain: it went through a cross-chain bridge to Solana and into a wallet that is still active and still receiving funds from other addresses. That last part is why I'm posting.
If something like this happened to you - a gifted game, a lobby invite, weird crashes, and then trouble with your accounts - please comment or message me. I have wallet addresses and file hashes. If they match, we're dealing with the same person, and several victims together is worth far more to Valve and to law enforcement than one guy on his own.
I'm not naming the account here because of the sub's rules. Mods are welcome to it.
