Hello, If you're a person who enjoys malware and/or knows Python and wants to see malware that targets STEAM and GAMERS, I have the source code to a malware I have named "Stealer.Python.GMBA.Manipulator". This malware was originally noted on Xitter from @GMBA. In summary, this Python malware kills the Steam process and relaunches it with the "-cef-enable-debugging" flag. Because Steam is a Chromium app, this allows the malware payload to manipulate Steam web pages with web socket gunk and Javascript gunk. This malware can "modify" user inventories, "block users", etc. It is all a facade designed to trick and social engineer Steam users into giving their expensive Counter Strike stuff to them. It appears to be written using AI. Regardless of that fact this malware is creative and I like it. The malware source code to this can be found under the "/Python/" directory. It is named "Stealer.Python.GMBA.Manipulator.7z". This malware campaign is still active and the C2 is still live. If you execute the __main__.py file you might cook yourself, so be careful. Alternatively, you can run this in a VM and send the malware campaign authors pictures of Goatse. github.com/vxunderground/Mal…

I got the payload to this malware. It is absurdly silly. This malware is killing me bro. It is so unbelievably silly. This was 100% written using Claude or ChatGPT. I've never seen a malware payload LEAVE NOTES describing what it's doing. The malware has a Powershell script that connects to the C2 for stinky malware stuff. This module is responsible for persistence. Thankfully their persistence script documented the entire code base and file locations. Very cool. Thank you spoopy Russian Counter Strike scammers. Even more silly, the C2 is hardcoded as a string (seen in attached image). The C2 address shows it has been an active malware campaign since at least January 31st, 2026 based off of data present on VirusTotal. It was initially uploaded as "9lixh". This persistence script was from a victim machine so I've censored some data. Regardless, the botched cyrillic notes also makes me giggle. Russian to English translations present in this silly script which documents everything for us: # Пути для удаления # Paths for deletion # Завершаем процессы python и pythonw # Terminate/finish the python and pythonw processes # Удаляем автозапуск из реестра # Remove autorun from the registry # Завершаем процесс монитора # Stop the monitoring process # Новая функция для проверки f.json и убийства процессов # New function for checking f.json and killing processes # Проверяем флаг library # Check the library flag # Список процессов для убийства # List of processes to kill # Проверка флага удаления (каждые 20 секунд) # Check the deletion flag (every 20 seconds) # 20 секунд при интервале 2 секунды # 20 seconds with a 2-second interval # Проверка f.json и убийство процессов (каждые 4 секунды) # Check f.json and kill processes (every 4 seconds)

I learned quite a bit from this actually. I didn't know Steam was a Chromium app. Hence, you can kill Steam then relaunch it with the "-cef-enable-debugging" flag. Once you'll launched Steam with this, you can inject Javascript into Steam using Chromium "webSocketDebuggingUrl" stuff. This malware has a whole pseudo-framework of Javascript that can do: - Alert Bell (?) - Block pages - "Help page" (?) - Inventory manipulation - Steam library manipulation - Profile manipulation - Steam redirections Basically, this malware payload switches Steam into a Chromium debug state, then sends web debug requests (kind of like Chrome Dev Tools?) to manipulate the Steam pages. It injects Javascript. The chat window that spawns is from a remote host they control. This is really cool. Is it AI slop? Yes Is this code EXTREMELY easy to reverse engineer? Yes Did they unironically document their entire code base in Russian because it was (probably) written using Claude and the authors probably speak Russian? Yes Is this extremely creative and cool? Yes Special thanks to "pro" from 2c44. He handed me the payload and the decompiled Python. The malware .py was Base64 encoded ... so obtaining the original source was ridiculously easy.

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point. This Eclipse guy has really rocked the boat for Microsoft.