We recently received reports—which have now been verified—that certain mod on the Steam Workshop contain embedded malicious code designed to execute a "Official Steam Notice" phishing scam.
This malware tampers with your local Steam client to trigger fake official warning/ban pop-ups. These pop-ups trick users into clicking a "Contact Support" button, directing them to phishing pages designed to steal account credentials, payment passwords, or even induce direct money transfers. Sadly, several players have already experienced account theft and financial loss as a result.
As of 9:00 AM today (Sept 2, UTC+8), we have permanently removed the offending mod from the Steam Workshop and issued a permanent ban to the author.
Additionally, the offending mod re-uploaded stolen content from existing mods and used illegitimate methods to artificially inflate its upvotes and comment engagement, pushing it onto trending pages to maximize downloads. Please stay vigilant and do not blindly trust mods that gain unusually high upvote counts in a short period.
I. Identified Malicious Mods & Authors
Banned Mod Author:
Author: 冬郁 | Malicious Code / Malware Insertion
Banned Workshop Mod:
CF 美国妞厚礼蟹 击杀音效 | Malicious Code / Malware Insertion
II. Actions Taken
Permanent Ban: The identified author and all of their Workshop submissions have been permanently banned.
Platform Coordination: Detailed technical logs and information have been submitted to Steam/Valve for further platform-level enforcement.
III. Inspection & Recovery Guide (For Affected Players)
If you have downloaded the affected mod, please follow the steps below immediately.
CRITICAL: Do NOT change your password before clearing the malware. You must thoroughly clean your system first, or your new credentials will be compromised as well.
Step 1: Verify the Authenticity of Pop-ups (Check for Compromise)
The "Contact Support" button inside the fake pop-up is a phishing link. To verify the URL:
Right-click the link/button inside the pop-up window and select "Copy Link Address".
Paste the URL into your browser's address bar to check the domain.
Valve Official Notice: Steam Support ONLY operates under help.steampowered.com
According to Valve, all official Steam login and support pages strictly use the following four domains:
Step 2: Remove the Mod & Malware
Unsubscribe & Clean Files: Unsubscribe from the affected mod on the Steam Workshop, then manually delete any remaining local files associated with it.
Full System Antivirus Scan: Run a full system scan using your antivirus software. Reboot your PC and run a second scan to ensure no residual files remain. (Note: If your antivirus doesn't flag it initially, update your virus definitions to the latest version and scan again.)
Reinstall Steam Client: Because the malware actively modifies core files of the Steam client, a standard antivirus scan may not fully repair the client. Completely uninstall Steam, delete any leftover folder remnants, and perform a fresh reinstall from the official Steam website.
Step 3: Secure Your Account (Only After Cleaning Your System)
Once you are 100% sure your PC is clean and Steam has been reinstalled:
Change Your Steam Password Immediately.
Enable Steam Guard Mobile Authenticator: Open the Steam Mobile App, go to Steam Guard, and set up Two-Factor Authentication (2FA).
Audit Credentials & Devices: Check if passwords saved in your browser or other apps have been leaked. Deauthorize all recognized devices/sessions in your Steam account settings. If your account shows signs of unauthorized access, submit a ticket at help.steampowered.com to recover it.
Step 4: Stay Vigilant Against Suspicious Demands
Steam will NEVER charge money or require payment verification to unban or unlock an account. Any pop-up demanding "scan-to-pay" unfreezing fees is a fraud.
Ignore any suspicious pop-ups. Take a screenshot for evidence and report the incident through official Steam channels.
IV. Special Thanks
We extend our sincere thanks to the following players and community members for providing malware samples, verifying clues, and posting early warnings:
周铁男是我: For publishing crucial warning threads and the comprehensive self-help guide "Steam Fake Red Ban Malware Self-Check & Recovery Guide".
Warning Thread: xiaoheihe.cn/app/bbs/link/189605704
Guide Link: xiaoheihe.cn/app/bbs/link/183459027
射命丸政MChannel: For reporting the compromised mod.
孤酒咕叽咕叽: For reporting the compromised mod.
Thank you all for your support and vigilance in keeping our community safe. If you notice any suspicious activity or unsafe behavior while using Workshop mods, please report it through our official customer support or community channels. We will investigate and take action right away. Official Customer Support:
https://bilibiligame.aihelpcn.net/webchatv5/#/bilibiligame_platform_c2cafc28c329858b60b7c055dcf098c3?entranceId=E001&language=zh-CN