Second Steam listing this year found hiding ‘new and clever’ malware. This time through a fake demo link on developer’s website

We are once again reminding you to be careful out there, after users found another Steam game acting as a front for malware. This is the second game we’ve seen hiding malicious intent on Steam’s storefront this year, and though both games have been taken down, it’s worth being extra cautious around unknown listings.

According to The Gamer, Sniper: Phantom’s Resolution, or Phatnom’s if you go by the game’s logo, was listed as a fairly typical looking FPS where players would be “navigating hostile environments and face moral dilemmas,” all set “in a world where justice and survival collide.” I suppose that’s one way to describe downloading and dealing with Malware.

The offending game was first spotted by Reddit users, and swiftly turned into an investigative collaboration. This time the game page was used purely as a front, using fairly generic looking images complete with misspellings, slated with a future release date, and no game actually available to download through Steam. Instead any potential detection through Steam was bypassed by directing users to the developer website which touted a download link to a demo for the game.

Unsurprisingly, users found the link did not provide a demo but instead installed malware onto their PCs.

The good news here is that most of the folks talking about this online seem to be very aware of how dodgy this all looked. Rather than a group of victims, instead we have some curious and capable individuals who managed to safely use a virtual machine to get a closer look at this malicious software. The bad news is it seems somewhat sophisticated.

In digging deeper, Reddit user meantbent3, deduced the malware to be an information stealer and described it as “something new and clever.” It gets access to administrator privileges, bypasses Windows encryption, and steals all the data on your PC all while largely avoiding detection by virus scanners.

While it’s long been taken down, you can get a look at the dodgy listing using the Way Back Machine. This includes a developer update to the game from the 20th of this month, which warns people about downloading the game from any other source than Steam. This could point to a weird social experiment from the creator, so make sure to keep yourself ever vigilant out there when clicking mysterious links.