The FBI has arrested a 21-year-old student charged with hiding cryptocurrency-stealing malware inside fake games published on Steam.
Prosecutors accused Zyaire Wilkins of uploading several counterfeit titles to Valve's platform, each bundled with malware designed to compromise players' machines. The scheme infected thousands of victims, according to court filings, with at least some losing cryptocurrency from their wallets as a result. Wilkins faces federal charges for the alleged operation.
Gaming platforms make unusually effective delivery vehicles for this kind of attack: users expect to download and run large executables, security software routinely whitelists game directories to avoid performance slowdowns, and a listing on a trusted storefront strips away the suspicion that a cold download would trigger. Wrapping a cryptostealer inside something that at least resembles a game is a low-effort way to clear that credibility bar.
For anyone who installed unfamiliar Steam titles recently, the charges are a reminder that a storefront page is not a security audit.