Among the targets were browser extensions like MetaMask, used to manage digital assets.
The investigation claims that the attackers sought to gain access to crypto wallets and sensitive data stored in the browser.
Valve removed Beyond The Dark after discovering malware capable of stealing data and cryptocurrencies.
Among the targets were browser extensions like MetaMask, used to manage digital assets.
The investigation claims that the attackers sought to gain access to crypto wallets and sensitive data stored in the browser.
After the investigation began to go viral, Valve removed Beyond The Dark from Steam.
For now, the company has not issued an official statement explaining the reasons for the removal. The game had been released in December 2024 and maintained a “Mixed” rating based on just 39 reviews.
The official description portrayed Beyond The Dark as a psychological horror game set in dark hallways and supernatural mysteries.
However, nothing within the public listing indicated the presence of malicious software. The case has once again highlighted the focus on security controls within digital distribution platforms.
Eric Parker explicitly urged not to install the game and recommended reporting any promotional attempts related to the title.
He also warned that some accounts may have been compromised to help distribute the threat.
Valve removed the free game Beyond The Dark from Steam after a technical investigation revealed it contained malware capable of stealing user information.
The case gained relevance after an analysis published by specialized YouTuber Eric Parker, who detected suspicious activity within the files of the supposed horror game developed in Unity.
According to the investigation, the game hid malicious code within the UnityPlayer.dll file. The malware ran in the background while the game functioned normally as a facade.
Eric Parker explained that the software was capable of communicating with external servers and downloading additional malware components.
The technical analysis was conducted within an isolated virtual machine to avoid compromising real systems. Although initially Windows Defender did not detect threats, specialized tools like Procmon allowed for the identification of abnormal network activity.
The investigator also discovered that the game loaded the Unity engine reflectively while executing hidden processes.
According to Eric Parker's video, the malware had functions aimed at stealing information related to cryptocurrencies.