Malware Disguised as SteamCleaner Uses Valid Signature to Inject Node.js RCE Backdoor

Researchers from the AhnLab Security Intelligence Center (ASEC) have uncovered a malware campaign that repurposes the long‑abandoned SteamCleaner open‑source project to distribute a Node.js remote command‑execution backdoor. The fake installer, masquerading as a legitimate Steam client cleanup utility, is signed with a valid digital certificate and employs anti‑sandboxing and obfuscation techniques to evade detection, according to ASEC’s analysis.

The threat actor downloaded SteamCleaner’s code, injected malicious components, rebuilt the installer with InnoSetup, and signed it to appear authentic; once executed, the malware copies itself to C:\Program Files\SteamCleaner\ and runs hidden in the background. Distribution is mainly through sites offering illegal software, with redirects to GitHub repositories hosting modified Setup.exe installers.

After bypassing sandbox checks, the malware decrypts and executes a PowerShell command that installs Node.js and fetches two malicious scripts from attacker‑controlled servers, registering them as scheduled tasks for persistence. One script acts as a downloader and connects to C2 servers such as rt-guard[.]com and 4tressx[.]com, while the other executes commands via Node.js’s exec function to provide remote shell access.