Steam Game People Playground Hit by Malware via the Steam Workshop

Why It Matters

The breach erodes player trust in mod platforms and forces Valve and developers to strengthen content vetting, impacting the broader gaming ecosystem’s safety and reputation.

Key Takeaways

• Malicious FPS++ mod infected Windows users' game data
• Malware deleted configs, stats, and uploaded spam items
• Developer disabled Workshop, issued security update, re-enabled
• Incident highlights risks of unchecked community content
• Valve introduced safeguards after similar past attacks

Pulse Analysis

The Steam Workshop for People Playground was compromised on February 1 2026 when a malicious mod named “FPS++” was uploaded. Once enabled, the worm silently voted for itself, edited every workshop item belonging to the infected account, and re‑uploaded altered versions with added tags. It also created a duplicate public item, erased local configuration files, deleted maps, contraptions and preferences, and reset in‑game statistics while leaving playtime untouched. The damage was irreversible for most users, forcing some to resort to third‑party tools to spoof lost achievements. The developer responded by shutting down the Workshop, releasing a security patch, and restoring service on February 6.

This breach underscores a systemic vulnerability in user‑generated content ecosystems. Similar attacks have plagued titles such as Cities: Skylines (2022), Cities Skylines 2 (2024 DLL hijacking), and the Downfall mod for Slay the Spire (2023 account hijack). Valve’s November 2023 policy changes—mandatory code signing and stricter upload vetting—were intended to curb such abuse, yet the People Playground episode shows that determined actors can still bypass safeguards. The incident also raises questions about the effectiveness of Steam’s automated detection tools and the responsibility of developers to sandbox third‑party assets.

For publishers, the lesson is clear: enforce strict validation, isolate mods in sandboxed environments, and provide rapid rollback mechanisms. Users should treat workshop downloads with the same caution as any executable, verifying author reputation and limiting permissions where possible. Industry‑wide, a shift toward decentralized verification—such as community‑driven reputation scores or cryptographic signing of assets—could reduce reliance on a single gatekeeper. As the modding community continues to fuel game longevity, balancing openness with security will become a competitive differentiator, prompting platforms like Steam to invest further in proactive threat intelligence.

Steam game People Playground hit by malware via the Steam Workshop

By Liam Dawe · 9 Feb 2026 at 10:58 am UTC

Oh dear. People Playground from mestiez / Studio Minus recently had a major problem with malware pretending to be a mod in the Steam Workshop.

I would say this is a reminder to be careful on what you're downloading – but these types of things are quite difficult for normal users to spot until it's too late. For many it was too late, since this wiped away various things. On Windows at least, it's not clear if it affected Linux (with the game run via Proton).

In a PSA posted on Steam the developer said on February 1st they disabled the Steam Workshop, and a few days later released a security update to prevent the issue in future and as of February 6th they have enabled the Steam Workshop once again.

The developer has a forum post on Steam that goes over various details of what the malware did, here's an excerpt from it:

to put it simply: a mod was uploaded "FPS++" which turned out to be a worm malware.

here is a list of EVERYTHING the mod does (since people were asking to read the code themselves, which i will not share myself as its a security risk.) once the game is launched with the mod enabled:

1. silently votes and favorites the mod (FPS++)

2. scans every workshop item you published, edits all of them silently, re‑uploads content, changes descriptions (1 in 2 chance to add "optimized" to the new mod's description), adds tags, up‑votes and favorites all of those items.

3. creates and uploads a brand‑new public workshop item under your account. copies the mod’s files, title, thumbnail, and description into it. up‑votes and favorites that new item too.

4. resets your steam stats for the game, such as achievements. your playtime is untouched. also deletes configs, control schemes, stats, caches, maps, contraptions, and prefs.

5. wipes mod json files and empty mod folders.

6. disables every other mod except itself and one hard‑coded name.

7. makes fps cap 10000, disables shady code protection.

8. makes it look like the mod is working by multiplying the fps counter, lmao.

everything—except achievements—are completely gone and unrecoverable after you’ve been infected. if you want your achievements back, you can use 3rd‑party tools that i will not link in order to spoof the game into thinking you had the achievements you previously had. although this is technically cheating, so is your achievements being deleted after a ♥♥♥♥ decides to delete them all.

The Steam Workshop is a place where you can find some really amazing work from the community, but such a system is clearly open to abuse of different forms. Like back in 2022 the city‑builder Cities: Skylines had an issue with multiple mods noted in a Reddit post, but a later announcement from the Cities: Skylines team clarified there were other issues that led to their removal. Then in 2024 a mod for Cities Skylines 2 as confirmed by Paradox Interactive was subject to a DLL hijacking attack.

Steam as a whole has been hit by malware directly in games multiple times too, with Valve announcing changes in November 2023 to hopefully prevent some of the issues.

In December 2023 we also had the developers of the standalone Slay the Spire mod Downfall announce a security breach where a malicious upload was able to overtake the game completely due to their Steam and Discord accounts being hijacked.

There's probably more cases but it really shows you can never be too careful.

Article taken from GamingOnLinux.com.