The FBI has opened a formal investigation into malware-infected games distributed through Steam, and federal investigators are now asking victims to come forward. The agency has named seven specific titles tied to the case and is collecting detailed reports from anyone who downloaded them.
Use code TRYHARD33 at checkout to redeem this offer before code expires again.
Get 33% Off GAMES+ Subscription
Seven Games Named in the Federal Investigation
The FBI's official victim services page lists the games under investigation: BlockBlasters, Chemia, Dashverse / DashFPS, Lampy, Lunara, PirateFI, and Tokenova. All seven were available on Steam between May 2024 and January 2026.
Anyone who downloaded these games during that period can report their experience by emailing [email protected] or filling out a form on the FBI's website. The form requests your Steam ID, which game you installed, the date you downloaded it, whether anyone contacted you or paid you to play, and the amount of money you lost.
Federal investigators are building a comprehensive timeline by cross-referencing download dates, wallet addresses, and other identifying details to track down the individuals behind the operation.
How These Scams Worked
PirateFI was the most visible case. The free-to-play survival game with web3 features pulled in over 7,000 players before Valve removed it from Steam in February 2025. The game functioned as a delivery mechanism for malware. A Telegram account was paying people to play and moderate the title, which explains why the download count spiked so quickly. The malware ran for about six days before Valve pulled the game and told affected users to wipe their operating systems completely.
Later, in September 2025, BlockBlasters became the center of another attack. A streamer raising money for cancer treatment was sent the game. A malicious file labeled game2.bat had been added to the game's directory a month earlier. That file drained more than $32,000 from the streamer's crypto wallet. Hundreds of users had the game installed at the time. The streamer was eventually reimbursed, but the incident revealed a dangerous tactic: hiding malicious code inside a game update after the title has already passed Steam's initial review and built a small player base.
The real problem is how much legitimacy Steam's storefront provides. Users see a game listed on a platform they trust and assume it's safe, even when they'd normally be more cautious.
Malware hidden in plain sight
The Broader Security Implications for Valve
The BlockBlasters case took a strange turn when security researchers traced stolen data through Telegram accounts and eventually found a suspect who had posted photos of cars on social media, along with links to their YouTube and X profiles. The VX Underground account on X followed the trail of compromised data to identify the person behind the scam using publicly available information the scammer had shared themselves.
The FBI's investigation window ending in January 2026 suggests no new cases have surfaced recently, but the attack method these scammers used will keep Valve security teams busy. Bad actors proved that injecting malicious files into a post-launch game update is an effective way to slip past Steam's initial vetting process.
The FBI's general safety recommendations apply:
- Never share financial or personal information with accounts you don't recognize
- Treat any investment or financial advice from people you meet online with extreme caution
- Do not pay additional fees if you have already been scammed
- Avoid services that promise to recover lost funds
If you installed any of the seven named games between May 2024 and January 2026, scan your system for unusual activity and report your experience to the FBI even if you didn't lose money directly.
Make sure to check out more:
Frequently Asked Questions (FAQs)
Which Steam games are named in the FBI's malware investigation?
The FBI has identified seven games: BlockBlasters, Chemia, Dashverse / DashFPS, Lampy, Lunara, PirateFI, and Tokenova. These titles were active on Steam primarily between May 2024 and January 2026.
How do you report being a victim of Steam malware to the FBI?
Victims can contact the FBI directly at [email protected] or fill out a form on the FBI's official website. You'll need your Steam ID, the name of the game you downloaded, the approximate download date, and details about any financial losses.
What should you do if you downloaded one of these games?
The FBI recommends reporting your experience even if you're unsure whether you suffered a financial loss. Valve previously advised users who downloaded PirateFI to reformat their operating systems. You should also monitor your accounts for unusual activity and avoid paying any third-party services that claim to recover lost funds.
