People Playground Hit by Second Malware Mod Attack
The Steam sandbox game People Playground has had its Workshop disabled after a malicious mod distributed malware on September 21st.
The developer of the Steam sandbox game People Playground has disabled the game's Steam Workshop and warned players not to launch the title following a second major malware attack this year. According to developer Mestiez, a malicious mod was uploaded to the Workshop on September 21st, prompting an urgent security alert.
Mestiez announced the action in a Steam post on September 22nd. "You might have noticed the Workshop has disappeared again," the developer wrote. "I disabled it quite a few hours ago due to yet another malicious mod. This one is especially bad." The developer urged anyone who played People Playground with mods enabled between 6PM and 8PM Central European Summer Time on September 21st to run an anti-virus scan immediately.
Malware Capabilities and Player Action
The malware associated with the mod is described as particularly severe. Mestiez stated it could perform a range of damaging actions, from permanently deleting a significant amount of personal user data to vandalising Steam configuration and cloud save data for other games. The malware is also capable of publishing personal information from a user's Discord account to the Steam Workshop.
Initial developer assurances that the malware did not steal passwords or credentials were later retracted. Mestiez has since crossed out that claim and now recommends that affected players change the passwords for all their important accounts as a precautionary measure. The explicit instruction from the developer is to delete all mods from the game's mods folder and to not open People Playground until an official all-clear is given on Steam.
A Recurring Security Problem
This incident marks the second time in 2024 that People Playground has been compromised via its Steam Workshop. A report by Kotaku notes that a similar attack occurred in February. That earlier malicious mod interfered with players' game files, contraptions folders, and mod lists, leading Mestiez to temporarily disable the Workshop then as well.
The developer has taken full responsibility for the security lapse. This is entirely my responsibility, and we gain nothing from throwing around rumours or speculations, Mestiez wrote, declining to speculate on who might be behind the attack. The focus remains on securing the game and its modding platform to prevent future incidents. For now, the Workshop remains offline, and players are advised to stay away from the game until further notice.
