Hi everyone. You might have noticed the Workshop has disappeared again. I disabled it quite a few hours ago due to yet another malicious mod. This one is especially bad.
What should you do?
If you have mods and opened the game on 21 September, in between 6 and 8 PM CEST, you might want to run an anti-virus scan. Delete all your mods in your mods folder and do not open the game until I've announced on Steam that it's safe to do so.
What does it do?
I can't say with certainty what exactly happened or what this program did, but it's not looking good. From what I can tell, it will do the following: - Permanently wipes a considerable amount of your personal data
- Vandalises your Steam config and Steam cloud data (inventory, workshop, etc.) for various other games
- Reads your Discord username and other identifiable information and publishes it to the Workshop (which is now disabled and can no longer be read)
- Publishes itself to the Workshop in order to spread It DOES NOT steal your passwords, tokens, cookies, or other credentials. It will not hack you, but it's a catastrophic piece of malware nonetheless.
Change your Discord password as soon as possible.
To be safe, probably change the passwords of all your important accounts in order to invalidate any session tokens that could have been included.
Who did this?
Nobody knows. Do not harass anyone or blame anyone other than me. This is entirely my responsibility, and we gain nothing from throwing around rumours or speculations.