Threat reportSupply ChainTL-2026-0774
BlockBlasters Steam Game Supply-Chain Compromise Delivers StealC Infostealer and StimBlaster Backdoor via Malicious Patch (Build 19799326)
BlockBlasters Steam Game Supply-Chain Compromise Delivers (TL-2026-0774), also tracked as BlockBlasters, is a high-severity supply-chain compromise, first published 2026-06-10 and last reviewed 2026-10-16. It has no confirmed attribution, affects Genesis Interactive BlockBlasters (Steam App ID 3872350), maps to 30 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 30MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-0774
- Threat ID
- TL-2026-0774
- Also known as
- BlockBlasters, BlockBlasters Steam malware, Build 19799326 compromise
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- gaming, cryptocurrency, consumer, individuals, content-creators
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 34
- Updates
- 2026-10-16 · revalidated 1× · latest source
Malware and tooling in BlockBlasters Steam Game Supply-Chain Compromise Delivers
Malware and tooling: Stealc, StimBlaster, Telegram bot (exposed token)
How BlockBlasters Steam Game Supply-Chain Compromise Delivers works
The legitimately published Steam game BlockBlasters (Genesis Interactive, App ID 3872350) was weaponized via a malicious patch (Build 19799326) on 30 August 2025 that chained batch/VBS loaders into the StimBlaster backdoor and StealC infostealer. The malware harvested Steam credentials, IP/geolocation, browser secrets, and cryptocurrency wallets, draining an estimated $150,000+ from 261-478 victims before Steam pulled the title on 21 September 2025.
BlockBlasters was a free-to-play 2D platformer published on Steam (App ID 3872350) by 'Genesis Interactive' on 30 July 2025. The initial release was benign and accumulated favorable reviews, establishing trust before the title was weaponized. On 30 August 2025 the developers pushed a malicious update — Steam Build 19799326 — that added a multi-stage infostealer chain to the otherwise functional game, a classic post-release supply-chain compromise that evaded Valve's pre-publication checks because the malicious code arrived as an out-of-band patch rather than in the original submission.
The infection chain begins with game2.bat, a batch dropper bundled in the game files. It performs environment reconnaissance — querying ipinfo.io and ip.me for the victim's public IP and geolocation — then enumerates running antivirus processes to fingerprint the host's defenses. It harvests Steam session artifacts (SteamID, AccountName, PersonaName, RememberPassword tokens) from the local Steam installation and POSTs the collected data to a command-and-control endpoint at http://203.188.171.156:30815/upload. The batch stage also adds the path Drive:\SteamLibrary\steamapps\common\BlockBlasters\Engine\Binaries\ThirdParty\Ogg\cwe\ to Microsoft Defender's exclusion list, blinding the on-host AV before unpacking later stages.
VBS loaders (launch1.vbs invoking 1.bat, and test.vbs invoking test.bat) run subsequent stages via hidden cmd.exe windows to minimize user-visible artifacts. Password-protected archives (v1.zip, v3.zip, archive password '121') unpack two binaries: Client-built2.exe — a Python-compiled backdoor that G DATA classifies as Win64.Backdoor.StimBlaster.L6WGC3 — and Block1.exe, the StealC information stealer (Win32.Trojan-Stealer.StealC.RSZPXF). test.bat additionally collects installed browser extensions and cryptocurrency wallet data and exfiltrates it to C2.
StealC is a well-documented commodity infostealer that uses RC4 encryption to obfuscate its API resolution and key strings, and performs anti-virtualization / anti-analysis checks to evade sandboxes. In this campaign it targeted the Local State key-material files of Chromium-family browsers — Google Chrome (\Google\Chrome\User Data\Local State), Brave (\BraveSoftware\Brave-Browser\User Data\Local State), and Microsoft Edge (\Microsoft\Edge\User Data\Local State) — to decrypt stored passwords, cookies, and autofill data, alongside selected desktop crypto wallets and browser wallet extensions. A secondary StealC C2 at http://45.83.28.99 received the stealer's exfiltration.
Distribution relied on social engineering rather than a vulnerability: the operators identified cryptocurrency holders on Twitter/X and sent direct invitations to play the verified, well-reviewed game. The most prominent victim was Raivo Plavnieks (streamer 'RastalandTV'), a Latvian gamer livestreaming a fundraiser for stage-4 sarcoma treatment, who was drained of ~$32,000 on-stream; crypto influencer Alex Becker later donated $32,500 to cover the loss. Crypto investigator ZachXBT tied ~$150,000 in theft to 261 compromised accounts, while VXUnderground estimated up to 478 victims and published victim usernames urging password resets. OSINT attribution — unconfirmed by law enforcement — points to an Argentinian operator residing in Miami, Florida, identified through operational-security failures including a publicly exposed Telegram bot and access tokens used for exfiltration. BlockBlasters is the fourth notable Steam-ecosystem malware incident of 2025, underscoring a structural gap in post-release update monitoring on the platform.
MITRE ATT&CK techniques used in TL-2026-0774
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Impact
defense-impairment
Affected products and versions in BlockBlasters Steam Game Supply-Chain Compromise Delivers
- Genesis Interactive — BlockBlasters (Steam App ID 3872350)
Vulnerable versions: Build 19799326 (patched 2025-08-30)
Fixed in: Removed from Steam 2025-09-21 - Valve — Steam (game distribution / client credential store)
Vulnerable versions: Any client running compromised BlockBlasters build - Google — Chrome (Local State credential store)
Vulnerable versions: All - Brave Software — Brave Browser (Local State credential store)
Vulnerable versions: All - Microsoft — Edge (Local State credential store)
Vulnerable versions: All
Remediation for BlockBlasters Steam Game Supply-Chain Compromise Delivers
Immediate actions
- Block C2 IPs 203.188.171.156 and 45.83.28.99 at the perimeter and egress proxy
- Hunt for and uninstall BlockBlasters (Steam App ID 3872350) from all endpoints
- Reset Steam credentials and revoke active Steam sessions for any host that ran the game
- Rotate all browser-stored passwords and move cryptocurrency wallets to clean, hardware-backed storage
- Inspect Microsoft Defender exclusion list for the BlockBlasters\Engine\Binaries\ThirdParty\Ogg\cwe\ path and remove it
Workarounds
- Run cmd.exe/wscript.exe child-process monitoring under Steam game directories
- Enable tamper protection on Microsoft Defender to block exclusion-list modification
Longer-term hardening
- Deploy EDR with behavioral detection for batch/VBS loader chains and Defender exclusion tampering
- Restrict or monitor consumer game platforms on corporate endpoints
- Alert on outbound requests to ipinfo.io / ip.me from non-browser processes as a recon signal
Weaknesses (CWE) in BlockBlasters Steam Game Supply-Chain Compromise Delivers
Timeline of BlockBlasters Steam Game Supply-Chain Compromise Delivers
- BlockBlasters published on Steam (App ID 3872350) by Genesis Interactive as a free-to-play 2D platformer; initial release benign, accrues positive reviews to build trust.
- Malicious patch (Steam Build 19799326) pushed, adding the batch/VBS loader chain, StimBlaster backdoor (Client-built2.exe), and StealC stealer (Block1.exe) to the game files.
- Game flagged as suspicious on SteamDB; G DATA MXDR begins analysis of the malicious build's files and behavior.
- Latvian streamer Raivo Plavnieks (RastalandTV) drained of ~$32,000 in cryptocurrency live on stream during a stage-4 cancer fundraiser after being invited to play the game.
- G DATA, VX-Underground and independent crypto investigators reportedly accessed the unauthenticated upload server and extracted victim logs (478 accounts), malware files and attacker communications; the attacker infrastructure was then deleted when confronted (single-source report: CyberInsider).
- Valve removes BlockBlasters from Steam after the malware is publicized.
- Crypto influencer Alex Becker donates $32,500 to replace the streamer's stolen funds; VXUnderground reports the alleged operator to ICE.
- G DATA and BleepingComputer publish analyses; ZachXBT attributes ~$150,000 theft across 261 compromised accounts; VXUnderground estimates up to 478 victims and publishes victim usernames.
- OSINT (unconfirmed by law enforcement) links the operation to an Argentinian individual residing in Miami via an exposed Telegram bot and leaked access tokens.
Update history for TL-2026-0774
- 2026-10-16 — BlockBlasters Steam Game Patch (Build 19799326) Delivers Batch/VBS Stealer, Python Backdoor and StealC: What changed No severity, exploitability or status change. The existing record already reflects ACTIVE exploitation and HIGH severity; the newer report's MONITORING status and LOW attribution confidence are not applied (status would be a do
Sources cited for BlockBlasters Steam Game Supply-Chain Compromise Delivers
- BlockBlasters: Infected Steam game downloads malware disguised as patch
- Verified Steam game steals streamer's cancer treatment donations
- Steam Pulls BlockBlasters After StealC Infostealer Hits 261+ Users
- BlockBlasters: When a Steam Game Turns Into a Malware Delivery Vehicle
- BlockBlasters Steam Game Downloads Malware to Computer Disguised as Patch
- Steam Pulls Game After Malware Steals Over $150,000 in Crypto
- BlockBlasters Malware Exploits Steam Platform to Steal Sensitive Data
Detection coverage for TL-2026-0774
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0774 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0774
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.