On Christmas day, the Downfall mod for the well-liked card game Slay The Spire became a tool for cybercriminals. Described as having a "security breach," the mod was manipulated to spread malicious software, known as malware, that had the capability to pilfer passwords from individuals' internet browsers. This included stealing credentials from popular messaging services like Telegram and Discord.
Gamers affected by this breach were met with an unusual "Unity library installer popup" when they initiated the Downfall mod. This unwelcome occurrence was a sign that their system was being targeted by the malware. The developers of the mod, aware of the situation, took swift action and by 1:40pm ET (6:40pm GMT) on December 25th, they announced that they had reversed the hack, curbing the spread of the malware.
The Downfall developers elaborated on the malware's inner workings, explaining that it was designed to scrape and collect passwords from an array of sources on a user's computer. Passwords at risk included those saved within browsers such as Google Chrome, Microsoft Edge, Mozilla Firefox, as well as other internet software like Brave and Vivaldi. Additionally, the malware sought after login credentials from Windows, and tried to locate any files on the hard drive that might have contained the word "password" in their filename.
A worrying facet of this malware attack was that most antivirus programs did not automatically prevent the malware from executing initially. However, they were successful in thwarting the malware's efforts to transmit the collected information across the internet, which meant that users were not necessarily harmed if their antivirus was active and up-to-date. Consequently, the Downfall mod's developers advised their community to still be vigilant and conduct a thorough check for any suspicious files.
Files linked to the malware were reported to appear sporadically throughout various directories on users' computers. For individuals seeking to investigate, the developers strongly advised doing so while disconnected from the internet to avoid inadvertently allowing the malware to communicate or spread.
Furthermore, for those who had witnessed the suspicious Unity installer popup, the developers recommended that they should take immediate preventative action. Urging users to change important passwords, especially for accounts that did not have two-factor authentication (2FA) enabled, was stressed as a crucial step in safeguarding against potential identity theft or fraud.
The incident has considerably affected the reputation of the Downfall mod, which is known for its expansive addition of new playable characters, a novel mode, and other engaging content to the base Slay The Spire game. Following this episode, the team behind Downfall have shifted their focus to developing Tales & Tactics, a standalone project featuring auto-battling Chess combined with roguelike elements.
This event serves as a stark reminder of the potential vulnerabilities in the gaming community, where mods—often created by smaller, independent developers—can become targets for malicious attacks. It highlights the importance for both developers and players to maintain rigorous security practices to protect against such threats. The quick response and transparency from the Downfall developers in addressing the breach is a testament to their commitment to their community's safety and stands as an example for how to handle such intrusions in the future.
