GoKawiilValve removes free horror game from Steam after players discover it contains malware that steals your data
PC Guide is reader-supported. When you buy through links on our site, we may earn an affiliate commission. Read More
Every month, over a thousand new games land on Steam. Many of them are harmless indie projects or small experimental titles. However, on rare occasions, one may slip through that turns into a complete nightmare for players. That’s sort of what happened with a free horror game called Beyond The Dark.
Valve has now removed it from Steam after it was discovered to contain malware designed to steal personal data and cryptocurrency. The interesting part of this mishap is that it was previously a different game entirely, which may have helped dupe players and Valve – the malicious actor hijacked an existing Steam title rather than trying to publish something brand-new.
Sign up for our free, weekly newsletter! Subscribe By signing up, you acknowledge our privacy policy and may receive occasional deal communications; you can unsubscribe anytime. Leave this field empty if you’re human:
Beyond The Dark had malware hidden inside
YouTuber Eric Parker investigated the game and published a video explaining what was happening behind the scenes. According to their findings, the malware was hidden inside a file called UnityPlayer.dll.
The game was originally called Rodent Race. However, someone reportedly hijacked the developer’s Steam account and quickly transformed it into Beyond The Dark – changing its name, screenshots, and other store details. As Steam does not fully verify every patch made to a game, the modified version was reportedly able to go live without raising immediate red flags.
A disclaimer on the store notes that “all game art and logos” were AI-generated, before being “manually modified”. We imagine that AI may have been used to speed up the transformation process.
What’s interesting is that while the game itself often crashed during launch, the malicious software continued running quietly in the background. The malware allegedly searched for cryptocurrency wallet browser extensions, including MetaMask, before connecting to external servers and downloading additional tools. These tools were reportedly capable of stealing browser information, passwords, and cryptocurrency wallet data.
... continue reading