Steam Workshop Mod Compromise Diagnostic Matrix
Steam Workshop hosts millions of community-created extensions for sandboxed games such as Garry's Mod, Teardown, Project Zomboid, and Tabletop Simulator. Attackers execute supply-chain hijacking by purchasing abandoned popular workshop items or compromising modder developer accounts, pushing malicious Lua or C++ updates that download infostealers, execute remote shells, or harvest browser cookies and Steam session tokens.
| Attack Vector | Underlying Mechanism | Target Assets | Manifested Warning Signs |
|---|---|---|---|
| Obfuscated Lua Script | Base64/XOR encoded string evaluation (compilestring) | Discord tokens, browser credentials | Antivirus flags gamemodes or addons folder |
| HTTP Exfiltration Payload | http.Fetch or http.Post to unlisted C2 domain | Steam cookies, system IP, hardware ID | Suspicious outbound network traffic on port 80/443 |
| Binary Dropper (.dll / .exe) | Lua calling external dynamic libraries | Full OS persistence, crypto miners | Windows Defender alerts on gmod_extra.dll |
| Workshop Auto-Update | Silent background update pushed by hijacked creator | Unattended zero-day deployment | Sudden game crashes or rogue pop-ups on server join |
Step 1: Auditing Downloaded Workshop Cache Files
Workshop items are downloaded into numerical directories under your Steam library root:
- Navigate to the physical workshop staging directory:
[SteamLibrary]\steamapps\workshop\content\[AppID]\
(For example, Garry's Mod AppID is 4000).
2. Search for obfuscated scripts containing suspicious execution wrappers using PowerShell:
Get-ChildItem -Path "[SteamLibrary]\steamapps\workshop\content\4000" -Recurse -Filter "*.lua" | Select-String -Pattern "compilestring", "RunString", "fromhex", "base64"
- Legitimate mods rarely pack multi-layered Base64 payloads inside raw gameplay logic. Any matches referencing remote domains or encoded alphanumeric strings warrant immediate inspection.
Step 2: Intercepting Malicious Outbound Network Calls
To verify whether a subscribed mod is covertly exfiltrating session tokens or communicating with a command-and-control (C2) server:
- Launch Sysinternals
TCPVieworWireshark. - Filter network traffic by the game's executable (e.g.,
hl2.exeorProjectZomboid64.exe). - Launch the game and load a single-player save.
- If the game process attempts outbound HTTP/HTTPS connections to unknown raw IP addresses, Discord webhook endpoints, or Pastebin URLs while in single-player offline play, an active exfiltration payload is executing.
- Terminate the process immediately.
Step 3: Emergency Incident Response and Account Sanitization
If an infected workshop mod has executed on your host machine:
- Unsubscribe from the compromised item on Steam Workshop and delete the corresponding numeric subfolder inside
steamapps\workshop\content\[AppID]. - Revoke all active Steam browser sessions:
- Steam > Settings > Security >
Deauthorize all devices.
- Steam > Settings > Security >
- Reset your Steam account password from a clean, separate device (e.g., your smartphone).
- Run a comprehensive malware scan with Windows Defender Offline Scan:
Start-MpWDOScan
- Check your Steam Web API Key settings (
https://steamcommunity.com/dev/apikey) and immediately revoke any key registered without your knowledge.