Steam ragdoll abuse game hit by second malware-infected mod this year

People Playground, the Steam sandbox game where players poke, prod, and otherwise torment ragdolls built like crash test dummies, has had its Steam Workshop switched off after a "malicious mod" carrying malware made it through moderation. Developer Mestiez is warning anyone who played the game with mods on September 21st to scan their machine for viruses, and is asking all players to leave the game closed until the all-clear is given.

"You might have noticed the Workshop has disappeared again," Mestiez explained in a Steam announcement posted on September 22nd. "I disabled it quite a few hours ago due to yet another malicious mod. This one is especially bad."

What players should do

The developer is asking anyone who launched People Playground with mods active between 6PM and 8PM CEST on September 21st (5PM to 7PM BST) to run an anti-virus scan as soon as possible. "Delete all your mods in your mods folder and do not open the game until I've announced on Steam that it's safe to do so," Mestiez wrote.

According to the developer, the malware behind this mod is capable of some serious damage. It can permanently erase "a considerable amount of your personal data", tamper with your Steam configuration and the Steam cloud data of other games, and even publish personal information from your Discord account straight to the Steam Workshop.

Mestiez initially reassured players that the malware "DOES NOT steal your passwords, tokens, cookies, or other credentials", but that statement has since been crossed out. The developer now recommends that anyone worried about their safety should "change the passwords of all [their] important accounts in order to invalidate any session tokens that could have been included."

Not the first time

Mestiez says there is no point guessing who is behind the attack, stating: "This is entirely my responsibility, and we gain nothing from throwing around rumours or speculations." As Kotaku reports, this is the second malware incident to hit People Playground through a Steam Workshop mod in the past year. Back in February, a malicious mod tampered with the files, contraptions folders, and mod lists of affected players, which led Mestiez to temporarily disable the Workshop — exactly the same precaution being taken now.

If you are one of the regulars who enjoys flinging ragdolls around, it may be worth holding off on both the game and its modding scene until Mestiez confirms things are secure again, and keeping a close eye on the Steam news page for that announcement.

Source: the original publisher