Steam

Overview

Trojan:Win32/Steam is a heuristic classification for a highly specialized category of infostealer trojans that exclusively target users of the Valve Steam gaming platform. Their primary objective is to bypass Steam Guard authentication, steal account credentials, and hijack valuable in-game inventories for financial gain.

Understanding Steam Trojans
To the end-user, this malware operates silently in the background, only becoming apparent when their Steam account is hijacked and their high-value virtual items (like CS:GO skins) are transferred away. For security analysts, this represents a highly lucrative, specialized cybercriminal ecosystem. The attackers are not after corporate data; they are targeting the grey-market virtual economy where digital items can be sold for thousands of real-world dollars.

Execution and Evasion Strategies
Steam stealers are frequently distributed via phishing links sent through Steam chat, fake game patchers on forums, or malicious browser extensions offering 'inventory calculators'. Upon execution, the trojan specifically targets the Steam installation directory (`C:\Program Files (x86)\Steam`). It searches for the `ssfn` files (which store the Steam Guard hardware authorization token) and the `config.vdf` file (containing encrypted credentials). By exfiltrating the `ssfn` file (`T1555`), the attacker can bypass Two-Factor Authentication (2FA) and log into the victim's account from a remote machine. Advanced variants may inject code into the active `steam.exe` process to intercept credentials during login.

Indicators of Compromise & Impact
The impact is the total loss of the Steam account and associated digital assets. Incident responders will observe anomalous 'File Read' activity by an unknown process targeting the Steam installation directory. Network logs will reveal HTTP POST requests exfiltrating the `ssfn` files to the attacker's C2 server. EDR platforms may flag attempts to hook APIs within the `steam.exe` process.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_STEAM {
    meta:
        description = "Detects Steam (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "steam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Steam Activity
id: 75eec5a819fd971e63a55c466a36211c
status: experimental
description: Detects generic indicators of the steam malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*steam*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network to halt the active exfiltration of the Steam Guard authorization files (`ssfn`).
2. Immediately deauthorize all other devices via the Steam client settings and initiate a password reset for the Steam account.
3. Revoke the compromised user's Steam Web API key if one was generated by the attacker to automate inventory theft.
4. Assume all locally saved passwords have been compromised, as Steam stealers often bundle generic browser credential harvesting capabilities.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is isolated to Steam; many of these stealers also grab browser cookies and saved passwords, endangering corporate access.
2. Avoid allowing the user to log back into Steam on the infected machine until a clean OS rebuild is performed.

References & External Analysis

• Search "steam" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Fraud
• Netwire
• Procpatcher
• Guildma
• Gtbot

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/steam.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.