World news and discussion on TalkFuse.
People Playground disables Steam Workshop again after malware-laced mod attack
Developed over time first seen 2 months ago
People Playground, a Steam sandbox game, has had its Steam Workshop disabled for the second time in a year following the discovery of a malicious mod distributing malware. Developer Mestiez described this latest attack as "especially bad" and urged all players to cease playing the game and run antivirus scans if they accessed mods during the incident window, highlighting serious ongoing security vulnerabilities in community-modded games that pose significant threats to player data and account security.
The malware was active between 5PM and 7PM BST on 21 September and can permanently delete personal data, corrupt Steam configuration and cloud data for other games, and expose Discord account information. The developer initially stated the malware does not steal passwords or tokens, but has since revised this guidance, now advising players to change passwords for all important accounts as the malware may have compromised session tokens. This represents the second malware incident affecting People Playground's Steam Workshop in a year, with the previous attack occurring in February.
- Sources
- 2
- Outlets
- 2
- Left · Centre · Right
- 0 · 0 · 0
In short
- People Playground's Steam Workshop disabled again due to malicious mod
- Malware deletes data, corrupts Steam accounts, exposes Discord information
- Players advised to change all important account passwords immediately
How this story developed
- 2 months ago The developer has accepted full responsibility for the security failures, and players must await official confirmation before reopening the game.
- 2 months ago Players who accessed mods during the incident have been instructed to delete all mods, run antivirus scans, and change passwords for important accounts, as the malware may have exposed sensitive information.
- 2 months ago People Playground's Steam Workshop has been disabled for the second time in a year after malware embedded in a community mod was found to have been active on 21 September, capable of deleting personal data and compromising session tokens despite developer denials that have since been revised.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Platforms and developers hosting user-generated content bear a duty of care to implement robust security measures, particularly after a first breach demonstrates vulnerability. Steam and Mestiez should have deployed sandboxing, mandatory code review processes, cryptographic signing, or runtime restrictions on mods—standards now commonplace in other ecosystems. The second attack within twelve months reveals systemic failure, not mere misfortune. Players invested trust and data in what ought to be a reasonably secure system, and platforms profiting from mod engagement have both the resources and responsibility to protect them.
The case against
Perfectly securing an open modding ecosystem without destroying its essence is near-impossible; malware attacks ultimately reflect the intentions of attackers, not platform negligence. Demanding absolute security would require centralized gatekeeping that eliminates the creative freedom making modding communities valuable. Users who install third-party mods necessarily accept some risk in exchange for that freedom—a tradeoff different from closed platforms. The developer has responded transparently, taken responsibility, and engaged remediation; this represents appropriate accountability rather than evidence of irresponsibility.
Explained simply
People Playground is a game on Steam, the world's largest digital storefront for video games, where players can experiment with physics and create scenarios. A defining feature of many games is their Steam Workshop, a community hub where ordinary players design and share modifications (mods) that alter or extend gameplay. These user-generated additions let games evolve beyond what their developers initially created, and players can download and install them directly into their game.
The appeal of mods to both players and developers is clear: they extend a game's lifespan and keep communities engaged. However, because mods are created and uploaded by millions of players worldwide rather than being checked by a central team before release, they can pose security risks. Malicious actors can hide harmful code within a mod, which then has access to a player's computer and linked accounts such as Steam or Discord, potentially enabling theft or damage.
People Playground has already experienced security incidents of this type, making this an ongoing rather than isolated concern. The situation illustrates a wider tension in modern gaming: the industry has embraced player-created content as a cornerstone of community engagement, but the way mods are freely distributed creates security vulnerabilities that are difficult to eliminate completely. This dynamic means that players must weigh the benefits of using mods against the real, though varied, risks they can pose.
Coverage · 2 sources
Americas Cybersecurity Entertainment Gaming Health Medicine Software Technology
Read the full article at the source →
Originally published by Rock Paper Shotgun as ““This one is especially bad”: Steam game about mistreating ragdolls suffers second bout of mod-based malware this year”.