Steam account credentials phished in browser-in-a-browser attack

Steam users are once again under threat from a particularly sneaky tactic used to steal account details. As with so many Steam attacks currently, it accommodates for the possibility of users relying on Steam Guard Mobile Authentication for additional protection. It also makes use of a recent...

Malicious code in readabl-steam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcbf5cc7344d4e657689d8590d1b7a4523f68d26682f07dac10e3f3b9c75ff19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5702 Malicious code in readabl-steam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcbf5cc7344d4e657689d8590d1b7a4523f68d26682f07dac10e3f3b9c75ff19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

$6 million heist targets video game skin trading site

An incredibly popular digital item trading site has suffered a spectacular loss at the hands of wily attackers. According to Bleeping Computer, CS Money lost out on $6 million via just 20,000 pilfered items. How did this happen, and why are digital items so popular in the first place? The digitiz...

lrzip 安全漏洞

lrzip is a compression utility program by the individual developer Con Kolivas. A security vulnerability exists in lrzip version 0.641, which stems from a memory leak in nasmmalloc in its steam.c component...

Fake Esports voting sites looking to phish Steam users

We’ve seen Esports occasionally become the focus of gaming or Steam scams. One particular tactic of note was to claim joining an official league is an easy process. Links to third-party hosted files would offer up a supposedly cracked ESEA Esports league client. In reality, it was a data stealing...

‘Cities: Skylines’ Gaming Modder Banned Over Hidden Malware

The developer of several popular mods for the Cities: Skylines city-building game has been banned after malware was discovered hidden in their wares. The modder, who goes by the handle Chaos as well as Holy Water, reportedly tucked an automatic updater into several mods that enabled the author to...

Rockstar Games: Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend

An improper authentication vulnerability was discovered in the Rockstar Games Launcher. This vulnerability allowed attackers who had already gained access to a victim's Steam or Epic Games account to also gain access to the victim's Social Club account. By exploiting the "Switch Account" feature...

Capcom Arcade Stadium’s record player numbers blamed on card mining

Some of my favourite retro video games are making waves on Steam, but not in the way you might think. Classics such as Strider, Ghosts n’ Goblins, and more are all available as content for Capcom Arcade Stadium. This is an emulator which lets you play 31 arcade games from the 80s/90s. The games...

Multiple video games break after domain name snafu

We’ve seen quite a few complaints from gamers this past weekend, unable to load up and play games on the Steam platform. The problem wasn’t hackers, or DDoS attacks, or anything else. Rather, the issue is something bundled with the game by default designed to keep titles “secure” from tampering...

Free Discord Nitro Offer Used to Steal Steam Credentials

There’s a new scam making the rounds on Discord, through which cybercriminals can harvest Steam account information and make off with any value it contains. Gamer-aimed Discord scams are just about everywhere. But researchers flagged a new approach as noteworthy because it crosses over between...

This Steam phish baits you with free Discord Nitro

Weeks ago, we talked about the one effective lure that could get a Discord user to consider clicking on a scam link they were generously given, either by a random user or a legitimate contact who also happened to have fallen for the same ploy: free Discord Nitro subscriptions. And similar to how...

Watch out for the Steam skin “free knife” scam

Have you ever had someone run up to you in the street and insist you take their free knife? I hope not, because that’s a good way to wind up in a 60-minute police procedural drama. In video game land, however, anything goes. A certain type of scam is showing signs of activity at the moment and it...

Squirrel Bug Lets Attackers Execute Code in Games, Cloud Services

An out-of-bounds read vulnerability in the Squirrel programming language lets attackers break out of sandbox restrictions and execute arbitrary code within a Squirrel virtual machine VM, thus giving a malicious actor complete access to the underlying machine. Given where Squirrel lives – in games...

Squirrel Sandbox Escape allows Code Execution in Games and Cloud Services

SquirrelLang is an interpreted, open-source programming language that is used by video games and cloud services for customization and plugin development. For example, the extremely popular game Counter-Strike: Global Offensive CS:GO attracts millions of players on a monthly basis and utilizes the...

TikTok Serves Up Fresh Gamer Targets

TikTok has made people do all sorts of wild things — eat frozen honey, work on their choreography and even fall for malicious malvertising campaigns. The latest TikTok attacks are getting served to gamers on the platform disguised as “free” or “hacked” versions of games like Among Us, free Steam...

Twitch Gets Gutted: All Source Code Leaked

An attacker claims to have ransacked Twitch for everything it’s got, including all of its source code and user-payout information. 100621 14:23 UPDATE: Twitch has confirmed the breach. According to Video Games Chronicle VGC, which first reported the assault on the interactive live-streaming...

Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

A security researcher helped Valve, the makers of the gaming platform Steam, plug an easy-to-exploit hole that allowed users to add unlimited funds to their digital wallet. Simply by changing the account’s email address, the exploit allowed anyone to artificially boost their digital billfold to...

How the Far Right Exploded on Steam and Discord

New research found that several of the major gaming platforms are hosting extremist activity, from racist livestreams to open support for neo-Nazis...

Valve: Modify in-flight data to payment provider Smart2Pay

I have found vulnerability which allows attacker to generate steam wallet balance. Firstly you will have to change yours steam account email to something like I will explain why in next steps, amount100 is the important part: brixamount100abc@█████ Then go to...