Malware sneaks onto Steam, for the third time this year

Hey, Valve. I know y’all are busy banning porn games and not making a new Steam Deck design. But is everything okay over there? I ask because, for the third time in 2025, someone’s been caught sneaking malware into a new game on the Steam storefront. This is becoming a trend.

According to security researchers at Prodaft (via BleepingComputer), this might not be a case of the game being uploaded via Early Access to spread malware. Instead, a known hacker injected the game files for post-apocalypse crafting game Chemia with spyware on July 22nd. Researchers say that two separate packages were remotely added to the game files, with the intention of being distributed via Steam’s store.

Both the HijackLoader and Fickle Stealer packages were discovered in the game’s download files. Chemia is still available to download for free on Steam via the Playtest feature, a sort of invitation beta program. The Early Access game has no release date and no current user reviews, so the number of actual infections may be quite low.

Games hosting malware on Steam were discovered in February (PirateFi) and March (Sniper: Phantom’s Resolution), but in both cases the games and the listings appeared to be deliberate fakes with stolen assets, presumably made with the sole intention of spreading malware via free downloads. They were both quickly removed from Steam.

Chemia was posted to the Steam store 15 months ago. There’s no indication that it’s anything but a legitimate game, albeit one of many thousands that get posted to Steam and then languish in development. It seems possible that the developer themselves (Aether Forge Studios, no other projects) got hacked and their access to Steam was compromised. Regardless, it’s a disturbing trend for those who trust Steam for safe downloads.