Steam Malware Game Chemia Exposes Crypto Wallets and Private Data

On July 22, 2025, the survival crafting game Chemia, available on Steam’s Early Access platform, became a major cybersecurity threat. Marketed as an indie game, Steam malware game Chemia turned out to be a vehicle for info‑stealing malware targeting gamers’ cryptocurrency wallets and personal information.

How Game Infected Players

Cybersecurity researchers from Prodaft discovered that Steam malware game Chemia came bundled with a trio of malicious programs: HijackLoader, Vidar Stealer, and Fickle Stealer. These were in the game’s executable files and activated silently when users launched the game.

Read Also: The Biggest Crypto Hacks in 2025 So Far

The game had a link to a fake developer account under the name Aether Forge Studios, which left no digital footprint, no website, no social accounts, no developer history. The malicious setup suggested a deliberate campaign by a sophisticated cybercriminal group called EncryptHub.

Steam Malware Game Chemia Used HijackLoader to Launch Attacks

The first stage of the infection involved HijackLoader, a backdoor trojan disguised as a file named CVKRUTNP.exe. Once executed, it enabled the attackers to run additional malware payloads on the user’s system. This opens the door for more serious data breaches.

Vidar and Fickle Stealer

Vidar, the second payload, is one of the most common data stealers on the dark web. It scraped browser data, autofill credentials, 2FA secrets, and crypto wallet information. Following this, Fickle Stealer was deployed via a file named cclib.dll, which then used PowerShell scripts like worker.ps1 to retrieve further malicious components from remote domains.

Game Remained Undetected While Running

Perhaps most disturbingly, the malicious activity happened without interrupting gameplay. Steam malware game Chemia ran as a fully functioning game, deceiving users into thinking it was legitimate while the game creators were quietly harvesting their data in the background.

The malware contacted its command-and-control infrastructure through Telegram channels, making it difficult for antivirus tools to detect suspicious outbound communications.

Timeline of Steam Malware Game Chemia’s Discovery and Removal

• July 22 – Malware is loaded into Chemia game files.
• July 23–24 – Prodaft analysts identify the infection chain.
• By July 25 – Steam removes Chemia from its store without comment.

At the time of writing, the game is no longer accessible on Steam, and Valve has yet to issue a public response. Steam deleted the fake developer profile.

Other Games With Malware in 2025

This incident marks the third known case in 2025 of a Steam game being used to spread malware. Earlier titles like Sniper: Phantom’s Resolution and PirateFi also contained Vidar Stealer and other data-exfiltrating payloads. Like Chemia, both were part of Steam’s Early Access program.

This suggests a potential pattern: attackers are exploiting Steam’s relatively looser security controls for indie developers and early-access content.

Real-World Impact

The threat posed by Steam malware game Chemia isn’t limited to gamer accounts or in-game data. Victims risk losing access to their crypto wallets, having their private keys stolen, and seeing personal files or identity documents leaked or sold on dark markets.

Read Also: After the Bybit Hack: How $3.64 Million Was Laundered Through DEXs

Cybercriminal groups like EncryptHub don’t stop at gaming profiles—they actively look for any financial or personal data they can monetize. And in a world where crypto adoption is booming, wallets are high-value targets.

Protecting Yourself from Attacks Like Steam Malware Game Chemia

To stay safe:

• Avoid random Early Access games with unknown developers.
• Never click on Discord links promoting obscure games, especially from strangers.
• Use antivirus with real-time protection and behavior monitoring.
• Avoid saving passwords or wallet keys in browsers.
• Monitor your crypto wallet activity for unauthorized transfers.

If you believe you may have played Chemia or similar games, perform a full malware scan and change all passwords linked to your browser or email.

What Steam Needs to Learn from Steam Malware Game Chemia

Valve must strengthen its game-vetting process, especially for Early Access titles. While it’s encouraging that Chemia didn’t last too long, the fact that it made it through to the store in the first place raises serious questions about platform safety.

With Steam being one of the largest PC gaming platforms globally, a breach like this could have ripple effects across millions of devices if left unchecked.