# BlockBlasters Steam Game Supply-Chain Compromise Delivers StealC Infostealer and StimBlaster Backdoor via Malicious Patch (Build 19799326)

> The legitimately published Steam game BlockBlasters (Genesis Interactive, App ID 3872350) was weaponized via a malicious patch (Build 19799326) on 30 August 2025 that chained batch/VBS loaders into the StimBlaster backdoor and StealC infostealer. The malware harvested Steam credentials, IP/geolocation, browser secrets, and cryptocurrency wallets, draining an estimated $150,000+ from 261-478 victims before Steam pulled the title on 21 September 2025.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-10-16T19:19:00.639Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0774
- **ID:** TL-2026-0774
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BlockBlasters was a free-to-play 2D platformer published on Steam (App ID 3872350) by 'Genesis Interactive' on 30 July 2025. The initial release was benign and accumulated favorable reviews, establishing trust before the title was weaponized. On 30 August 2025 the developers pushed a malicious update — Steam Build 19799326 — that added a multi-stage infostealer chain to the otherwise functional game, a classic post-release supply-chain compromise that evaded Valve's pre-publication checks because the malicious code arrived as an out-of-band patch rather than in the original submission.

The infection chain begins with game2.bat, a batch dropper bundled in the game files. It performs environment reconnaissance — querying ipinfo.io and ip.me for the victim's public IP and geolocation — then enumerates running antivirus processes to fingerprint the host's defenses. It harvests Steam session artifacts (SteamID, AccountName, PersonaName, RememberPassword tokens) from the local Steam installation and POSTs the collected data to a command-and-control endpoint at http://203.188.171.156:30815/upload. The batch stage also adds the path Drive:\SteamLibrary\steamapps\common\BlockBlasters\Engine\Binaries\ThirdParty\Ogg\cwe\ to Microsoft Defender's exclusion list, blinding the on-host AV before unpacking later stages.

VBS loaders (launch1.vbs invoking 1.bat, and test.vbs invoking test.bat) run subsequent stages via hidden cmd.exe windows to minimize user-visible artifacts. Password-protected archives (v1.zip, v3.zip, archive password '121') unpack two binaries: Client-built2.exe — a Python-compiled backdoor that G DATA classifies as Win64.Backdoor.StimBlaster.L6WGC3 — and Block1.exe, the StealC information stealer (Win32.Trojan-Stealer.StealC.RSZPXF). test.bat additionally collects installed browser extensions and cryptocurrency wallet data and exfiltrates it to C2.

StealC is a well-documented commodity infostealer that uses RC4 encryption to obfuscate its API resolution and key strings, and performs anti-virtualization / anti-analysis checks to evade sandboxes. In this campaign it targeted the Local State key-material files of Chromium-family browsers — Google Chrome (\Google\Chrome\User Data\Local State), Brave (\BraveSoftware\Brave-Browser\User Data\Local State), and Microsoft Edge (\Microsoft\Edge\User Data\Local State) — to decrypt stored passwords, cookies, and autofill data, alongside selected desktop crypto wallets and browser wallet extensions. A secondary StealC C2 at http://45.83.28.99 received the stealer's exfiltration.

Distribution relied on social engineering rather than a vulnerability: the operators identified cryptocurrency holders on Twitter/X and sent direct invitations to play the verified, well-reviewed game. The most prominent victim was Raivo Plavnieks (streamer 'RastalandTV'), a Latvian gamer livestreaming a fundraiser for stage-4 sarcoma treatment, who was drained of ~$32,000 on-stream; crypto influencer Alex Becker later donated $32,500 to cover the loss. Crypto investigator ZachXBT tied ~$150,000 in theft to 261 compromised accounts, while VXUnderground estimated up to 478 victims and published victim usernames urging password resets. OSINT attribution — unconfirmed by law enforcement — points to an Argentinian operator residing in Miami, Florida, identified through operational-security failures including a publicly exposed Telegram bot and access tokens used for exfiltration. BlockBlasters is the fourth notable Steam-ecosystem malware incident of 2025, underscoring a structural gap in post-release update monitoring on the platform.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1685 Disable or Modify Tools
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1518 Software Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1036 Masquerading
- T1119 Automated Collection

## Sources

- [BlockBlasters: Infected Steam game downloads malware disguised as patch](https://www.gdatasoftware.com/blog/2025/09/38265-steam-blockblasters-game-downloads-malware)
- [Verified Steam game steals streamer's cancer treatment donations](https://www.bleepingcomputer.com/news/security/verified-steam-game-steals-streamers-cancer-treatment-donations/)
- [Steam Pulls BlockBlasters After StealC Infostealer Hits 261+ Users](https://cybersecurefox.com/en/steam-blockblasters-stealc-infostealer-campaign-2025/)
- [BlockBlasters: When a Steam Game Turns Into a Malware Delivery Vehicle](https://securityonline.info/blockblasters-when-a-steam-game-turns-into-a-malware-delivery-vehicle/)
- [BlockBlasters Steam Game Downloads Malware to Computer Disguised as Patch](https://cybersecuritynews.com/blockblasters-steam-game-downloads-malware/)
- [Steam Pulls Game After Malware Steals Over $150,000 in Crypto](https://www.safetydetectives.com/news/steam-pulls-game-after-malware-steals-over-150000-in-crypto/)
- [BlockBlasters Malware Exploits Steam Platform to Steal Sensitive Data](https://advisory.eventussecurity.com/advisory/blockblasters-malware-exploits-steam-platform-to-steal-sensitive-data/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0774