BlockBlasters: When a Steam Game Turns Into a Malware Delivery Vehicle

BlockBlasters, a Steam game released on 31 July 2025, has become one of the most alarming cases of malware-laced games according to G DATA Security Lab, after a patch on 30 August 2025 (Build 19799326) introduced files capable of stealing credentials, browser data and crypto wallet information.

The infection chain begins with a suspicious batch file named game2.bat, which gathers IP and geolocation data, detects antivirus processes, and harvests Steam login details before uploading stolen data to a C2 server at hxxp://203.188.171[.]156:30815/upload. It then launches hidden VBS scripts to unpack password-protected archives and deploy two payloads: a Python-based backdoor and a StealC malware variant that can extract data from Chrome, Brave and Edge.

The malware uses RC4 encryption to obfuscate APIs and strings and communicates with a second C2 channel at hxxp://45.83.28[.]99. Telemetry indicated 100+ downloads since the infected patch, with only a handful of players remaining; one streamer reportedly had their system infected live on-air during a charity livestream, according to vx-underground.

According to G DATA, BlockBlasters’ removal from Steam came too late for many affected users, underscoring a supply-chain-like threat within mainstream gaming platforms.