BlockBlasters Steam Game Disguises Malware as Patch for Computer Download

BlockBlasters, a vibrant 2D platformer/shooter from Genesis Interactive, launched on 31 July 2025 but the August patch Build 19799326, released on 30 August 2025, concealed malware rather than a routine update. According to G DATA MXDR, the patch carried multiple malicious components capable of harvesting sensitive data from players’ PCs, including cryptocurrency wallet credentials.

Historical logs on SteamDB show that Build 19799326 installed several new files alongside the game's legitimate assets, and hundreds of players reported unusual system behaviour within hours.

The malware centres on a batch file, game2.bat, which initiates an information‑stealing routine as soon as the game launches, querying IP information from ipinfo[.]io and ip[.]me, scanning for antivirus processes beyond Windows Defender, and capturing Steam login credentials before uploading them to a command‑and‑control server at 203.188.171[.]156:30815/upload.

Two Visual Basic Script loaders then deploy payloads, with StealC exfiltrating browser data to 45.83.28[.]99 and exporting local state files and saved passwords. Valve has flagged BlockBlasters as “suspicious” on SteamDB and removed it from Steam; the incident also saw a streamer infected live during a fundraiser, underscoring the real‑world impact of such compromises.