Supply Chain Attacks on Steam: The Case of Beyond The Dark

The digital distribution of software is built on a trust model. When a user downloads a game from aSteam, they generally assume the software is safe. However, a recent incident involving a free horror game titled Beyond The Dark has exposed a critical vulnerability in how games are updated and published on the platform.

What began as a seemingly harmless indie project turned into a delivery mechanism for data-stealing malware, highlighting a broader trend of supply chain attacks targeting both developers and end-users.

The Anatomy of the Attack

The malware distribution didn't start with a new game submission, which might have triggered more scrutiny. Instead, the attacker hijacked an existing developer's Steam account. The original game, titled Rodent Race, was transformed into Beyond The Dark by changing the store page details, screenshots, and the game's name.

By leveraging an existing app ID and an existing presence on the platform, the attacker was able to bypass the initial vetting process that new games undergo. Because Steam does not fully verify every single patch or update made to a game, the malicious version was able to go live without raising immediate red flags.

Technical Execution

According to investigations by YouTuber Eric Parker, the malware was embedded within a file called UnityPlayer.dll. This is a common library used by the Unity engine, making it a stealthy place to hide malicious code.

Once executed, the malware performed the following actions:

  • Targeting Crypto Wallets: The software specifically searched for cryptocurrency wallet browser extensions, such as MetaMask.
  • External Communication: It connected to external servers to download additional tools.
  • External Data Theft: These tools were designed to steal browser information, passwords, and cryptocurrency wallet data.

Interestingly, the game itself often crashed during launch, which likely served as a distraction or simply reflected the poor quality of the shovelware. However, the crash did not stop the malicious background processes from continuing to run quietly.

Community Insights and Security Implications

The incident has sparked a discussion among the security community on Hacker News, with users pointing out several systemic issues with digital distribution platforms.

The Sandbox Question

One of the most pressing questions raised by users was why games—software that often requires high-level system access—are not run in a sandbox. As noted by @galad87, "Games are an almost perfect type of software to be run in a sandbox." This suggests that if the platform provider (Valve) would implement a mandatory sandboxing layer, the malware's ability to access browser extensions and system passwords would have been severely limited.

The Supply Chain Risk

Users also compared this attack to broader supply chain attacks, such as the recent "Shai-Hulud" attack on TanStack packages. This highlights a shift in the same pattern: attackers are no longer just trying to create new malicious software, but are hijacking existing, trusted channels to deliver their payload.

The "Shovelware" Warning

There is a general consensus that the instability of the game—the fact that it crashed—actually helped in its detection. Had the game been a polished, functional piece of software, it might have remained undetected for much longer. This serves as a reminder that the layanan (service) of "free" games often comes with a hidden cost if the source is not reputable.

How to Protect Yourself

For those who may have downloaded Beyond The Dark, the recommended course of action is immediate:

  1. Complete Deletion: Remove the game and all associated files from your system.
  2. Deep Scanning: Run multiple full antivirus scans to ensure the malware is completely removed.
  3. Credential Reset: Update all passwords, especially those related to financial accounts.
  4. Wallet Migration: Move cryptocurrency funds to a fresh wallet on a different device as a final precaution.

This incident serves as a warning that the trust we place in digital storefronts is not sufficient. Users should remain vigilant, especially when downloading free titles from developers they are unknown or when a game's store page looks suspiciously AI-generated.

Sources