On Christmas day, a favorite among the gaming community, the Slay The Spire mod called Downfall, became the target of a sophisticated cyberattack. This breach allowed nefarious individuals to distribute malware directly through Steam, the widely-used digital distribution platform for video games. The developers of Downfall informed the public that the primary function of this malicious software was to steal passwords.
The attack vector was quite deceptive; the malware would display what appeared to be a "Unity library installer popup" once the user launched the altered version of Downfall. It was through this seemingly harmless popup that the malware tried to conduct its harmful activities. Concerningly, the developers also noted that the majority of antivirus programs did not prevent the execution of the malware. They did, however, appear to block its primary function, which was to transmit stolen data over the internet. This means that while the malware could install itself on the player's system, it was often prevented from sending any stolen information back to the hackers.
The specific types of data the malware aimed to compromise were extensive. It was designed to scrape passwords associated with a variety of internet browsers—such as Google Chrome, Mozilla Firefox, Microsoft Edge, and more—and other applications including Telegram and Discord. In addition to these direct targets, the malware also searched for and collected files that might inadvertently include the word 'password'.
In the aftermath of this security incident, users reported strange files appearing in various locations on their computer systems, which the developers included in their official announcement. To prevent further damage, the advice was clear: Users who encountered the suspicious Unity popup should immediately undertake a series of preventative actions. One of the key recommendations was to disconnect from the internet if investigating any suspicious files potentially related to the breach. Moreover, users were urged to change critical passwords, with special attention to those which were not protected by two-factor authentication (2FA).
Downfall has been lauded as a significant enhancement to the base game of Slay The Spire. It provided gamers with fresh content, including new playable characters and innovative modes, helping to cement its popularity within the gaming community. Despite the setback of the breach, the developers have not been dissuaded from their creative pursuits; they are currently developing a new game known as Tales & Tactics, which is described as a standalone auto-battling Chess roguelike.
The incident with Downfall serves as a stark reminder of the vulnerabilities that exist within online communities, particularly in the realm of modded content. While mods can greatly enhance the gaming experience by offering new challenges, features, and excitement, they can also open up channels for cybercriminals to exploit.
For players and mod developers alike, this serves as a call to action to prioritize cybersecurity. Regularly updating software, employing robust antivirus solutions, and exercising caution with third-party mods are critical steps in protecting against such threats. To that effect, the gaming community is now more aware of the potential risks of modded content and the importance of cybersecurity vigilance to ensure that playtime remains safe and enjoyable.
