People Playground is a popular Steam game with hundreds of thousands of reviews that’s essentially a lo-fi physics sim for torturing stick figures. The game has been out since 2019, but has now succumbed twice in the same year to malicious mods on the Steam Workshop page. The developer is warning that the latest attack is the worst yet and urging anyone who recently played to wipe everything and run antivirus scans.
“You might have noticed the Workshop has disappeared again. I disabled it quite a few hours ago due to yet another malicious mod. This one is especially bad,” wrote developer mestiez in an update on Steam. Anyone who played on early on September 21 is being told to take extra precautions. “Delete all your mods in your mods folder and do not open the game until I’ve announced on Steam that it’s safe to do so.”
What is going on, exactly? Mestiez doesn’t sound entirely sure, but the malicious mod apparently hacks people’s computers, erases data, reads Discord, and self-publishes mods to Steam to keep the virus spreading. “I can’t say with certainty what exactly happened or what this program did, but it’s not looking good,” the developer wrote. The malicious mod potentially does everything from permanently wiping a considerable amount of your personal data to reading Discord usernames and other identifiable information and publishing it to the Steam Workshop.
Mestiez at one point wrote that the malware “DOES NOT steal your passwords, tokens, cookies, or other credentials. It will not hack you, but it’s a catastrophic piece of malware nonetheless,” but later deleted it and added, “To be safe, probably change the passwords of all your important accounts in order to invalidate any session tokens that could have been included.”
This isn’t the first time this sort of thing has happened to People Playground. The game came under attack back in February as well, but that malware only seemed to be messing up people’s game files and mod lists. This newer attack appears to be a lot more potentially harmful. Why does People Playground keep getting hit, and who’s responsible? Mestiez doesn’t know and asked players not to speculate. “This is entirely my responsibility, and we gain nothing from throwing around rumors or speculations,” they wrote.
But the post about the malware already has over 1,000 comments on Steam, and some players are just planning to stay away from People Playground permanently. “Crazy this is the first post even though there’s been several Malware mods pop up,” one wrote. “Other people like myself have already stopped playing and don’t plan to come back.” Another was similarly perplexed. “Crazy this is the only game I’ve seen that has malware not once but TWICE in my time of owning it,” they wrote. “I’m not gonna get all mad and rant, so ill keep it short. To the devs: this is SO not ok to have!”