{
  "family": "steam",
  "sample_count": 54,
  "category": "infostealer",
  "description": "Steam (cataloged across security intelligence feeds under signatures including Trojan:Win32/SteamStealer, PWS:Win32/Steam, and Trojan-PSW.Win32.Steam) is a targeted credential stealer and virtual asset theft malware family active since 2014. Aimed at gamers and esports communities, SteamStealer infiltrates systems through malicious links in gaming forums, weaponized Teamspeak/Discord voice chat updates, and fake Steam Community trade offers. Upon execution, the malware searches local storage for active Steam installations and extracts sensitive authentication session artifacts, including ssfn* secret configuration tokens, Steam client configuration files (config.vdf), and cached login tokens. Furthermore, SteamStealer can hijack active Steam sessions, initiate unauthorized trades of rare in-game cosmetic items and inventory assets to operator-controlled accounts, and capture keystrokes from online gaming platforms before exfiltrating stolen data over encrypted HTTP or Russian underground Telegram bots.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/SteamStealer",
    "PWS:Win32/Steam",
    "Trojan:Win32/SteamStealer!rfn",
    "Trojan-PSW.Win32.Steam",
    "Win32/SteamStealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/SteamStealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SteamStealer is an information-stealing trojan designed to hijack Steam accounts and steal valuable in-game inventory items."
      }
    },
    {
      "@type": "Question",
      "name": "How does SteamStealer bypass Steam Guard security protections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It steals the local ssfn* authentication files that tell Valve servers the machine has already completed two-factor verification."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers distribute SteamStealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through phishing messages on Discord and Steam, fake esports tournament sites, and malicious voice chat utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What inventory items are typically targeted by the malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rare weapon skins, trading cards, and virtual goods that can be liquidated on third-party marketplace portals."
      }
    },
    {
      "@type": "Question",
      "name": "How can gamers protect their Steam accounts from theft?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enable Steam Mobile Authenticator with trade confirmations, avoid clicking trade links from strangers, and run antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.004",
    "T1566.002",
    "T1056.001",
    "T1114",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to halt the active exfiltration of the Steam Guard authorization files (`ssfn`).",
    "Immediately deauthorize all other devices via the Steam client settings and initiate a password reset for the Steam account.",
    "Revoke the compromised user's Steam Web API key if one was generated by the attacker to automate inventory theft.",
    "Assume all locally saved passwords have been compromised, as Steam stealers often bundle generic browser credential harvesting capabilities."
  ],
  "what_to_avoid": [
    "Do not assume the threat is isolated to Steam; many of these stealers also grab browser cookies and saved passwords, endangering corporate access.",
    "Avoid allowing the user to log back into Steam on the infected machine until a clean OS rebuild is performed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft & Gaming Asset Liquidation",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Fake Steam Community Phishing Links",
    "Weaponized Voice Chat & Discord Updates",
    "Deceptive Esports Tournament Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "ssfn* Steam Token Theft",
    "config.vdf Session Extraction",
    "Automated Inventory Trade Hijacking",
    "Gaming Credential Keylogging",
    "Encrypted Telegram / HTTP Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (.NET / C++)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons uploading zipped ssfn and config.vdf files to C2 servers",
      "Telegram Bot API calls dispatching notification messages with stolen account credentials"
    ],
    "evasion_techniques": [
      ".NET code obfuscation via ConfuserEx",
      "Deleting local temp extraction files immediately after data transmission",
      "Masquerading as Discord or Teamspeak utility executables"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\SteamStealer\\stealer.exe",
        "%Temp%\\steam_ssfn_dump.zip"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SteamUpdateHelper"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "SteamStealer Framework"
    ],
    "variants": [
      "SteamStealer.NET",
      "SteamStealer.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1a2b3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef0",
      "2b3c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef01"
    ],
    "delivery": [
      "discord_voice_setup_v2.exe",
      "trade_offer_item_verifier.scr"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SteamUpdateHelper"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/SteamStealer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/SteamStealer"
    },
    {
      "name": "Kaspersky Securelist - Steam Stealers: The Evolution of Gaming Malware",
      "url": "https://securelist.com/steam-stealers-the-evolution-of-gaming-malware/74148/"
    }
  ]
}