Cryptocurrency theft scheme discovered via Steam

US authorities have arrested 21-year-old Florida resident Zyaire Dontaevious Zamarion Wilkins, accusing him of distributing malware through the Steam gaming platform. The malware is capable of infecting computers and stealing data and cryptocurrency.

From May 2024 to February 2026, Wilkins and his accomplices, according to prosecutors, added malware files to several video games distributed through Steam: BlockBlasters, Lunara, PirateFi, and Lampy. Investigators allege that Wilkins created accounts using the stolen personal information of US citizens. As a result, approximately 8,000 computers were infected and approximately 80 cryptocurrency addresses were compromised, from which assets worth over $220,000 were stolen.

Once installed, the malware collected sensitive information from victims' computers, including login credentials, browser cookies, and autofill data. The stolen information was used to access crypto wallets and steal digital assets. The infected games were promoted through the social network X, LinkedIn, and Discord, as well as the Telegram messenger. Investigators discovered that the stolen cryptocurrency was used to purchase gift cards through the Bitrefill platform. In total, over 150 digital goods and gift cards were purchased, including those for the food delivery service Uber Eats.

Last year, anonymous blockchain detective ZachXBT reported on the distribution of infected links through Steam that helped steal over $150,000.

Previously, security specialists at Prodaft discovered that hackers from the EncryptHub (Larva-208) group had introduced the HijackLoader malware into the game Chemia. The attackers gained access to players' personal data and crypto wallet access keys.