Steam’s Workshop just failed the same game twice in one year. On September 21, 2026, the ragdoll physics sandbox People Playground was hit by a destructive malware payload distributed through a Steam Workshop mod, the second such attack against the title since a less severe incident in February. The developer, a solo studio operating under the name Studio Minus, pulled Workshop support entirely and warned that it might never come back “if mods cannot be made fundamentally safe to run.” For a platform that hosts hundreds of millions of user-generated items across thousands of games, that is not a small admission.
The incident lands in the middle of a run of Steam-adjacent security failures stretching back to early 2025: PirateFi, Sniper: Phantom’s Resolution, Chemia, a Kaspersky-documented Wallpaper Engine campaign, an FBI victim notice naming seven infected titles, and now a repeat outbreak inside the same game’s Workshop. Each incident is small on its own. Together they describe a pattern security researchers have been warning about for more than a year: user-generated content platforms bolted onto trusted storefronts are becoming one of PC gaming’s most exploited attack surfaces, and the fixes so far have been reactive, developer-by-developer, rather than structural.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened to People Playground on September 21
People Playground is a physics sandbox where players torture, dismember, and otherwise experiment on ragdoll characters, and its appeal has always leaned heavily on Steam Workshop content: custom weapons, characters, and scripted scenarios built by the community. That same dependency is what made it vulnerable a second time. According to the developer’s own account, the exposure window ran from roughly 18:00 to 20:00 CEST on September 21, 2026, and covered any player who had mods installed and launched the game during that two-hour span.
Talk Fuse’s independent report on the attack pegged the same window at roughly 5:00 to 7:00 p.m. British Summer Time, the same two-hour stretch translated across time zones. The outlet corroborated that the malicious mod could delete personal files, access Discord identifiers, and replicate itself through further Workshop uploads.
The developer, who posts under the handle mestiez, disabled the Workshop on September 22, 2026, according to FIS Cybersecurity, and published a Steam announcement titled “Bad event.” In it, mestiez wrote that the situation was worse than the February incident. “You might have noticed the Workshop has disappeared again. I disabled it quite a few hours ago due to yet another malicious mod. This one is especially bad,” mestiez said, according to Dexerto’s reporting on the incident.
Players were told to take the malware seriously rather than treat it as a routine mod glitch. The exact instruction, as reported by Rock Paper Shotgun, was blunt: “Delete all your mods in your mods folder and do not open the game until I’ve announced on Steam that it’s safe to do so,” mestiez wrote. In the days that followed, Studio Minus shipped a new build that blocks mods from running at all, a step beyond simply disabling Workshop uploads, which FIS Cybersecurity confirmed as the follow-up to the September 22 shutdown. The developer said full mod support might only return if mods can be made safe by design, a bar that may never be cleared for a single-developer studio without dedicated security staff.
What the Malware Actually Did
Unlike a typical info-stealer that quietly exfiltrates saved passwords, the September payload behaved more like a worm crossed with a wiper. Based on the developer’s warnings and contemporaneous reporting, the malicious mod was capable of several distinct behaviors once triggered on a victim’s machine.
- Deleting or permanently damaging a substantial volume of a user’s personal files, independent of anything related to the game itself.
- Modifying or vandalizing Steam configuration data and Steam Cloud saves tied to other, unrelated games on the same account.
- Reading Discord-related information, including usernames and other identifying details, directly from the local client.
- Hijacking the victim’s own logged-in Steam session to republish the malicious mod back to the Workshop, turning each infected player into a new distribution point, according to FIS Cybersecurity.
- Uploading new malicious Workshop content, including versions grafted onto already-popular mods, which let the payload spread without needing a fresh malicious upload each time.
- Attempting to hijack victims’ Steam accounts outright, a more severe possibility than simply reading saved data, according to Dexerto’s reporting.
- Sending abusive, slur-filled messages to people on a victim’s Steam friends list directly from the compromised account.
3DJuegos’s comparison of the two 2026 incidents found the September payload had a measurably broader impact than the February attack. Where the first Workshop compromise was caught and cleaned up before it could do lasting damage, the repeat payload could permanently delete personal files, alter Steam configuration and cloud-save data, and read and publish Discord-identifying information, a wider and more destructive blast radius than the earlier incident.
The most alarming part of the timeline is a walk-back. The developer initially told players the malware did not steal passwords, session tokens, or cookies. That assurance was later struck from the announcement, and mestiez advised players to change passwords on any account they cared about, in case session tokens had been exposed, a caveat that suggests even the developer was still working out the full scope of the compromise days after disabling the Workshop. No independent cybersecurity firm has yet attached a named malware family, such as RedLine, Lumma, Vidar, or StealC, to the payload, and no verified figure for the number of infected accounts has surfaced as of October 2026.
Valve’s response, separate from the developer’s, was narrower: reports indicate the company removed Workshop items containing C# code, deleted items found to contain sensitive user data, and stripped out content uploaded or updated on or after September 21. There has been no public Valve statement laying out a platform-wide policy change, no CVE-style advisory, and no confirmed account of how many Steam users across the wider platform, beyond People Playground’s own audience, were exposed.
Not the First Time: A Timeline of Steam Malware in 2025-2026
People Playground’s September incident is not an isolated event. It is the latest entry in a timeline that stretches back roughly 19 months and now includes at least eight named games and one confirmed repeat victim.
| Date | Game / Campaign | What Happened |
|---|---|---|
| Feb 6-13, 2025 | PirateFi | Valve removed the free survival game within about a week of release after builds were found to contain credential- and cookie-stealing malware; Valve advised affected users to consider a full system reset. |
| March 2025 | Sniper: Phantom’s Resolution | Kaspersky documented a second 2025 case of malware distributed through an early-access Steam title, following the same build-tampering pattern as PirateFi. |
| July 22, 2025 | Chemia | A threat actor tracked as EncryptHub (also known as Larva-208) injected malicious files into the legitimate survival-crafting game; it became the third malware-tainted Steam game reported that year. |
| Feb 1-6, 2026 | People Playground (1st incident) | Studio Minus disabled the Workshop after malicious content was found circulating; a security update followed and Workshop access returned on February 6. Ground News later described this first incident as less severe than the September repeat that followed. |
| March 12, 2026 | FBI victim-identification notice | The FBI’s Seattle field office named seven titles tied to Steam malware investigations: BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova, all active on Steam between May 2024 and January 2026; Valve removed all seven from the store. |
| June 2026 | Wallpaper Engine campaign | Kaspersky disclosed a malware-distribution campaign abusing Steam Workshop and the popular Wallpaper Engine app to push infected animated wallpapers to unsuspecting users. |
| Sept 16-20, 2026 | SteamDB Workshop mod bans | Multiple reuploaded Workshop items, including listings named “Scratch Card v1.0.4” and “SmartPet — AI Smart VPet Hosting Plugin,” were banned after being found to contain injected malicious code inside previously popular mods. |
| Sept 21-24, 2026 | People Playground (2nd incident) | A more destructive malware outbreak used hijacked Steam sessions to republish itself to the Workshop; Studio Minus disabled mod support on September 22 and shipped a build that blocks mods from loading, warning full restoration may never happen. |
Kaspersky’s own review of the pattern, published on its Securelist research blog, frames the shift plainly: “Since late 2025, malware has been spreading rapidly through the Steam Workshop, the gaming platform’s built-in service for players to create and share custom content,” the firm wrote in its analysis. A separate Kaspersky press release on the Wallpaper Engine campaign put it even more directly: “Attackers abuse Steam Workshop to distribute malware disguised as desktop wallpapers, leading to infections and account theft,” the company said in its release.
Why Steam Workshop Is a Uniquely Attractive Target
Steam Workshop was built to solve a real problem: letting millions of players share mods, maps, and cosmetic items without forcing developers to run their own content-hosting infrastructure. That convenience is exactly what makes it dangerous from a security standpoint. Workshop items inherit a baseline of trust simply by existing inside the Steam client, the same application users already trust with their payment details and their game libraries. A malicious mod does not need to trick anyone into visiting a shady website or opening an email attachment. It only needs to look like a normal piece of community content sitting a few clicks away inside a game people already own.
The self-propagation angle seen in the September People Playground attack makes the problem worse than a single bad upload. By grafting malicious code onto mods that were already popular, rather than publishing a new suspicious-looking item from scratch, the payload could ride the existing trust and download momentum of content players had already vetted socially, through comments, ratings, and subscriber counts. That is a fundamentally different threat model than the PirateFi case, where an entire game was built as bait. Here, the delivery mechanism piggybacked on legitimate community trust that had accumulated over months.
There is also a resourcing gap that the People Playground case exposes starkly. Big publishers with dedicated Trust & Safety teams, automated scanning pipelines, and legal departments can respond to a Workshop compromise within hours. A solo developer cannot. Studio Minus’s response, disabling Workshop entirely and blocking mods at the engine level, is the only lever available to a one-person studio facing a repeat attack, but it also means the feature that likely drove a meaningful share of the game’s engagement is now gone indefinitely.
Market and Industry Impact
The direct financial impact on Valve is likely to stay contained. Steam’s business model does not depend on any single Workshop-enabled title, and the company has shown it will act quickly, pulling infected items and blocking new uploads once a threat surfaces. But the reputational cost compounds with each incident. Every new Workshop malware story feeds a narrative that community-content platforms across the industry, not just Valve’s, need independent security review rather than after-the-fact takedowns.
That narrative matters commercially because Workshop-style systems are now standard across the industry, not a Valve-only feature. Bethesda’s Creation Kit ecosystem, the third-party CurseForge platform used by Minecraft and other titles, and Nexus Mods all operate on the same basic trust assumption: user-submitted content is reviewed lightly, if at all, before it reaches millions of installations. A modding platform that gets a reputation for carrying malware risks losing the very thing that makes it valuable, the willingness of players to install content from strangers without a second thought.
For smaller developers specifically, the calculus is shifting. A modding community can meaningfully extend a small game’s lifespan and word-of-mouth reach for free, which is a large part of why titles like People Playground built their success around it in the first place. But as this incident shows, that same feature can become a liability that a one-person or small studio has no realistic way to defend, short of shutting it off.
How Steam Workshop Malware Compares to Other Gaming Platform Threats
Workshop-borne malware is only one branch of a broader set of platform-level threats that have hit PC gaming in 2026. Comparing them side by side helps clarify why the Workshop vector is particularly hard to close off using conventional patching.
| Threat Type | Example | Delivery Method | Who Can Fix It | Typical Fix Timeline |
|---|---|---|---|---|
| Workshop mod malware | People Playground (Feb and Sept 2026) | Malicious or hijacked user-generated mod uploaded to Workshop | Individual developer plus Valve moderation | Hours to days per incident, recurring |
| Malicious full game listing | PirateFi (Feb 2025) | Entire game built as a trojan, distributed through normal Steam storefront listing | Valve store review and takedown | About one week from launch to removal |
| Compromised legitimate build | Chemia (July 2025) | Attacker injects malicious files directly into an existing, trusted game’s update | Developer plus Valve, requires source-control audit | Days, dependent on developer detection |
| Client software zero-day | Steam BrokenPipe flaw (Sept 2026) | Local privilege escalation bug in the Steam Windows Client Service itself | Valve engineering, requires a client patch | Unresolved after roughly six months, per public reporting |
| Third-party app abuse | Wallpaper Engine campaign (June 2026) | Malware disguised as content for a popular companion app distributed via Workshop | App developer plus Valve moderation | Weeks, dependent on detection scale |
The pattern that emerges is that Valve-level fixes, like the September removal of C#-containing Workshop items, work reasonably well against a specific known payload but do nothing to prevent the next variant from using a different technique to reach the same trusted distribution channel. Client-side vulnerabilities such as the BrokenPipe flaw are arguably more dangerous individually, since they can affect any Steam user rather than fans of one specific game, but Workshop malware has proven more frequent and, because it targets community trust rather than a code flaw, harder to close permanently through a single patch.
Historical Context: From Modding Freedom to Modding Risk
Steam Workshop launched in 2011, initially built around Team Fortress 2 items before expanding into the general-purpose content platform it is today. For more than a decade, the pitch to developers was straightforward: let players build your marketing and content pipeline for free. Skyrim, Garry’s Mod, and later titles like Cities: Skylines all owe meaningful chunks of their long-tail sales to Workshop-powered community content that kept players engaged years after launch.
The security model behind that system was built for a much smaller and more benign modding community than the one that exists today. Community moderation, user reports, and spot checks were sufficient when Workshop uploads numbered in the low thousands and the financial incentive for attackers was minimal. That calculus has changed. Steam accounts are now valuable enough on their own, tradeable items, linked payment methods, saved credentials, that a modding platform reaching hundreds of millions of installs has become a rational target for credential-theft and account-takeover operations, not just a curiosity for researchers.
The FBI’s March 2026 notice naming seven infected titles, spanning nearly two years of activity from May 2024 through January 2026, is the clearest signal yet that this shifted from a nuisance-level problem into something federal law enforcement now tracks as an ongoing criminal pattern rather than a series of unrelated incidents.
What Players Should Do Right Now
Anyone who played People Playground with mods installed during the September 21 window, or who regularly installs Workshop content for any game, should treat the following as immediate housekeeping rather than optional advice.
- Delete all locally installed People Playground mods from the game’s mods folder, not just the ones downloaded recently.
- Run a full antivirus and anti-malware scan rather than a quick scan, since the reported payload touched files outside the game directory.
- Change the password on your Steam account and any other account that shares a password with it, and enable Steam Guard two-factor authentication if it is not already active.
- Review recent Steam account activity for unauthorized trades, purchases, or market listings.
- Check Discord account activity and consider rotating any tokens if you use Discord bots or third-party integrations linked to your account.
- Avoid launching any game with third-party mods installed until the developer explicitly confirms it is safe, rather than assuming silence means resolution.
What Developers and Platforms Should Consider
For studios that rely on Workshop-style modding, the People Playground case is a warning shot about the limits of manual moderation at scale. A single verified incident is a bad week. A second incident inside the same year, in the same distribution channel, suggests the underlying review process itself needs to change rather than simply being restarted after each cleanup.
Options on the table for platform operators include automated static analysis of uploaded scripts before they go live, sandboxed execution environments that isolate mod code from the host system’s file access, mandatory code signing for mods that request elevated permissions, and rate-limiting or manual review triggers when a previously-popular mod receives a sudden content update. None of these are free to build, and all of them add friction to a system whose entire value proposition has historically been near-zero friction. That tension, between openness and safety, is the real story behind this incident, more than the specific malware payload itself.
5 Predictions for Steam Workshop Security Through 2027
- Valve introduces mandatory automated scanning for script-containing Workshop items. Given that the September takedown specifically targeted items containing C# code, expect Valve to formalize static analysis as a pre-publish gate rather than a post-incident cleanup tool within the next 12 months.
- More solo and small-studio developers disable Workshop support entirely rather than risk repeat incidents. Studio Minus’s decision to block mods at the engine level, rather than just disabling uploads, sets a precedent that other under-resourced teams are likely to follow after their own first scare.
- Cybersecurity vendors expand dedicated gaming-platform threat coverage. Following Kaspersky’s Wallpaper Engine and Workshop research, expect at least one additional major security firm to publish a standalone report specifically tracking modding-platform malware as its own threat category by mid-2027.
- Federal law enforcement interest continues to grow. The FBI’s March 2026 victim-identification notice covering seven Steam titles is unlikely to be a one-off; a pattern spanning multiple games and nearly two years of activity typically draws follow-up investigative notices as more victims come forward.
- Account security requirements tighten industry-wide. Expect Steam and comparable platforms to push harder on mandatory two-factor authentication and session-token protections specifically framed around modding and Workshop risk, rather than general account security messaging alone.
The Bigger Picture for PC Gaming Security
None of this means Steam Workshop is broken beyond use, or that players should abandon modding altogether. The overwhelming majority of Workshop content, across thousands of games and hundreds of millions of items, remains exactly what it appears to be: fan-made content shared in good faith. But the People Playground case, arriving as the second confirmed incident against the same title within a single calendar year, is a clear signal that the current moderation model has not kept pace with the financial incentives now attached to compromising gaming accounts.
The honest framing, and the one Studio Minus itself arrived at, is that modding platforms built for an earlier, lower-stakes era of PC gaming now sit inside an ecosystem where a Steam account can be worth real money to an attacker. Until platform-level defenses catch up to that reality, individual developers are left choosing between the engagement benefits of open modding and the liability of policing it largely on their own. Heading into mid-October 2026, that trade-off remains unresolved for Studio Minus specifically. Ground News confirmed on October 14, 2026, that Workshop access for People Playground is still switched off more than three weeks after the September 21 attack, with the developer maintaining that mod support might never return and no public timetable announced for its restoration.
Frequently Asked Questions
Is People Playground safe to play right now?
As of October 14, 2026, more than three weeks after the September 21 attack, the base game is reported safe to play, but Steam Workshop support and mod loading remain disabled or blocked. Players should avoid installing or running any third-party mods until Studio Minus explicitly announces that Workshop functionality has been restored.
What should I do if I played People Playground with mods on September 21, 2026?
Delete every file in your mods folder, run a full antivirus scan, change your Steam password, enable two-factor authentication, and review your account’s recent trade and purchase history for anything unauthorized.
Did this malware steal Steam passwords or account credentials?
The developer initially said no, then removed that assurance and advised players to change passwords out of caution regarding possible session-token exposure. No independent confirmation of credential theft has been published as of October 2026.
Is this the first time a Steam game has been hit by Workshop malware?
No. People Playground itself was hit once before, in a less severe February 2026 incident, according to Ground News. Separately, Steam has seen at least three malware-laced game listings in 2025 (PirateFi, Sniper: Phantom’s Resolution, and Chemia), a Kaspersky-documented Wallpaper Engine campaign in June 2026, and an FBI notice in March 2026 naming seven affected titles.
What is Valve doing to fix Steam Workshop security?
Following the September incident, Valve removed Workshop items containing C# code, deleted items found to hold sensitive user data, and stripped content uploaded or updated since September 21. Valve has not announced a broader, permanent policy change for Workshop security screening.
How can I tell if a Steam Workshop mod is malicious before installing it?
There is no foolproof method, since this attack showed that even previously popular, trusted mods can be modified to carry malicious code. General precautions include checking for recent unexplained update activity, avoiding mods that request unusual permissions, keeping antivirus software active and updated, and waiting to install brand-new or recently-updated mods until other users have had time to report issues.
Are other modding platforms like Nexus Mods or CurseForge affected by similar risks?
Any platform that hosts user-generated content with light or no automated review carries a similar structural risk. While this specific incident is confirmed on Steam Workshop, cybersecurity researchers have flagged user-generated modding platforms broadly, not just Valve’s, as an area needing stronger automated screening.
Will Steam Workshop return for People Playground?
The developer has said Workshop and mod support will only return if mods can be made “fundamentally safe to run,” and acknowledged that bar might never be met. As of October 2026, no restoration date has been announced and mod loading remains blocked at the engine level.
