What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The July 2025 Chemia incident was a compromised-game incident, not confirmed evidence that Valve’s Steam client or entire Steam platform was hacked. Attackers reportedly inserted malicious files into the Steam-distributed files for the Early Access game Chemia. The reported payloads included HijackLoader, Vidar Stealer and Fickle Stealer, which can target browser data, credentials, system information, files and cryptocurrency-wallet information.
Anyone who downloaded and ran the affected build on Windows should treat the computer as potentially compromised: isolate it, scan it, and change important credentials from a known-clean device.
As an Amazon Associate I earn from qualifying purchases.
The short version
- Affected game: Chemia, an Early Access survival and crafting title from Aether Forge Studios.
- Reported compromise: July 22, 2025.
- Reported threat actor: EncryptHub, also known as Larva-208.
- Reported malware: HijackLoader, Vidar Stealer and Fickle Stealer.
- Primary risk: theft of browser sessions, passwords, files, system information and cryptocurrency-related data.
- Most important response: if you ran the affected build, stop using that computer for sensitive logins and begin recovery from a clean device.
Malwarebytes reported that malicious components were added to the game files distributed through Steam. BleepingComputer reported that the game continued to function, potentially making the compromise less obvious.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What happened inside Chemia?
On July 22, 2025, threat researchers reportedly identified malicious files in the Steam-delivered Chemia build. The incident was associated with EncryptHub/Larva-208. The exact route used to modify or replace the game files was not publicly established.
#1 Best Overall
The available reporting is consistent with a developer-side or software-supply-chain compromise. Possible explanations include a compromised developer account, a compromised build environment, or unauthorized modification of an upload or update process. Those are possibilities, not confirmed findings.
The reported chain included a loader capable of establishing persistence and retrieving additional payloads. BleepingComputer associated the incident with a file named CVKRUTNP.exe. Malwarebytes reported that the delivered malware included Vidar Stealer and Fickle Stealer. Removing the game from Steam may stop ordinary access to it, but it does not prove that already downloaded files were deleted, persistence was removed or stolen credentials were recovered.
Was Steam itself hacked?
No confirmed evidence in the cited reporting shows that the Steam client or Valve’s entire platform was breached.
The defensible description is that a trusted storefront distributed a compromised third-party game. That still matters: a platform can provide legitimacy and convenient delivery even when the underlying game files have been tampered with. But “Steam was hacked” claims go beyond what the public reporting established.
The incident shows the difference between a platform compromise and a software-supply-chain compromise. Steam delivered the game, while the precise point at which malicious content entered the Chemia distribution process remained unknown. Kaspersky’s comparison of the 2025 cases likewise distinguished the apparent delivery mechanisms.
Which malware was involved?
HijackLoader
HijackLoader is a loader used to establish persistence and retrieve or execute additional malware. The incident reporting associated it with the filename CVKRUTNP.exe and with two published SHA-256 indicators. A filename alone is not proof of infection, since attackers and legitimate software can reuse names.
Vidar Stealer
Vidar is an information stealer that can target browser data and other sensitive information. Malwarebytes also noted that Vidar has used public services and platforms, including Steam, in its command-and-control infrastructure. That does not mean Steam was its exclusive or necessarily primary command channel in this incident.
Fickle Stealer
According to Malwarebytes, Fickle Stealer can target system information, sensitive files, browser-stored data and cryptocurrency wallets. The report also associated it with PowerShell-based techniques intended to evade or bypass User Account Control protections. These are malware-family capabilities reported by Malwarebytes; they should not be read as a public forensic confirmation that every Chemia player lost every listed type of data.
What could attackers steal?
Infostealers commonly focus on data that is immediately useful for account takeover or financial theft, including:
- Browser cookies and active sessions.
- Saved passwords and autofill information.
- Steam credentials and gaming-marketplace assets.
- Cryptocurrency-wallet data.
- Local files and system information.
- Credentials for email, social networks, financial services, cloud accounts and work systems.
The important distinction is between what the malware can target and what was publicly confirmed to have been stolen from Chemia victims. The cited reports described targeting and capability, but did not establish a reliable public victim count or a complete forensic inventory of exfiltrated data. Confirmed Chemia-specific cryptocurrency losses were not established in the supplied reporting.
Who was actually at risk?
The clearest risk group was people who both:
- Downloaded the affected Chemia build or playtest through Steam; and
- Launched or otherwise executed it on a Windows computer.
Viewing the store page or having the game listed in a library should not automatically be described as an infection. Risk also depends on the particular build, the computer’s security controls and what accounts or wallets were accessible during or after execution.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Potentially higher-risk users included people who stored passwords in a browser, used cryptocurrency wallets on the same machine, used the computer for banking or business accounts, ran software with elevated privileges, reused passwords or had no active and updated endpoint protection.
The reported payloads were Windows malware. The available evidence does not establish equal risk for macOS, Linux or Steam Deck users. However, users should not assume another platform is automatically safe if they manually ran Windows executables through compatibility layers or installed external tools.
Why the Early Access pattern matters—and what it does not prove
Chemia was an Early Access or playtest title, and the other two prominent 2025 cases also involved pre-release games. Early Access is not malware and is not inherently unsafe. Pre-release projects can nevertheless involve frequent updates, smaller development teams, experimental builds and players who are more willing to install demos, patches, mods or external tools.
The concentration of reported cases in Early Access titles is notable, but the public evidence does not prove that Valve applies weaker checks to Early Access games or that such a policy caused these incidents. The correlation is a reason for caution, not proof of causation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How the three 2025 cases differed
| Game | Month | Apparent delivery path | Main lesson |
|---|---|---|---|
| PirateFi | February 2025 | Malware bundled with the game | A Steam listing is not a guarantee that every third-party executable is safe. |
| Sniper: Phantom’s Resolution | March 2025 | An external demo or installer associated with the game’s presence | External downloads create a separate attack path, even when Steam supplies discovery and credibility. |
| Chemia | July 2025 | Malicious files reportedly introduced into a Steam-distributed game build | A legitimate-looking project or update can potentially be compromised through a developer-side supply chain. |
For PirateFi, Kaspersky reported that malware could unpack as Howard.exe in a temporary AppData location and target browser cookies. Valve removed the game after a user report and notified people who had played it. Public download estimates varied, and the precise number of affected users was not established.
Sniper: Phantom’s Resolution differed because the suspicious payload was associated with an external demo or installer, including a GitHub-based route, rather than necessarily being embedded in the Steam-distributed game itself.
Chemia is particularly important because the reporting described malicious files inside the game distribution. It was not simply a fake game directing every victim to an unrelated external download.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you ran the affected build, do this now
1. Contain the computer
- Disconnect the computer from the internet or disable Wi-Fi.
- Do not log into email, banking, cryptocurrency, work or social-media accounts from it.
- Do not assume uninstalling Chemia removes persistence or reverses credential theft.
- If investigating a workplace or financial incident, preserve the game’s installation path, approximate download and launch times, security alerts, suspicious filenames, hashes and relevant event logs.
2. Scan and decide whether to reinstall
Run a full scan with an updated, reputable anti-malware product. A clean result is useful, but one scan does not prove that no credential or session data was stolen.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf detections persist, accounts show takeover activity or the system behaves suspiciously, a clean operating-system reinstall from trusted installation media may be the safest consumer remediation. Steam’s support guidance advises obtaining security tools only from official, trusted websites.
Best Value
3. Recover accounts from a known-clean device
- Change the email password first.
- Change the Steam password and enable Steam Guard.
- Change passwords for financial, social, work and cloud accounts.
- Revoke active sessions and unknown application tokens where available.
- Check recovery email addresses, phone numbers and MFA settings.
- Contact banks, payment providers and cryptocurrency exchanges if suspicious activity occurred.
- Move cryptocurrency assets to a new wallet if private keys or seed phrases may have been exposed.
- Do not reuse passwords that were stored in the browser on the potentially infected computer.
4. Monitor for follow-on abuse
- Review Steam Marketplace activity, inventory changes and unfamiliar trades.
- Check email-forwarding rules and account-login histories.
- Monitor bank and card statements.
- Watch for password-reset emails, new-device alerts and cryptocurrency withdrawals.
- Warn contacts if messaging or social accounts may have been hijacked.
Reported indicators of compromise
Malwarebytes published the following indicators. They are provided for defensive checking only. Do not browse the domains or execute suspicious files. A hash match is useful evidence; not finding a match does not prove that a computer is clean.
Domains
soft-gets[.]comreaitek[.]comsafesurf.fastdomain-uoemathhvq.workers[.]dev
SHA-256 hashes
- Fickle downloader:
ed076c27b420bfa66c251488b4121913fa461367a60c5fa32cee3953efcae32b - Fickle Stealer:
6fb7fd9763d6b269793c80bbc03a1be358390781af4b698fba1591cb8dbb8825 - Vidar Stealer:
2cd8c0e75cf76381f06dfe465a542e52eefa713b0bea2557763e0c0c45b21481 - HijackLoader:
9a733b2de84e2bf466287abd034b04b18c8c269535606e8f6403eee2a3b288c4 - HijackLoader:
12935315254175719cbbaad0b213204ddebd4100ffc551d54f8cf39ced1be227
These indicators come from Malwarebytes’ incident report. Security teams should use their normal, trusted threat-intelligence and endpoint tools rather than opening the listed infrastructure.
How to reduce the risk without abandoning Steam
- Keep Windows, Steam, browsers and security software updated.
- Treat unexpected demos, patches, mods, launchers and “verification” tools as separate software risks.
- Be cautious with unfamiliar file hosts, GitHub repositories, Discord attachments and direct executable downloads.
- Use MFA on Steam, email, financial, cryptocurrency and high-value accounts.
- Use unique passwords, ideally generated and stored by a password manager.
- Keep valuable credentials and wallet operations off gaming-only machines where practical.
- Do not dismiss antivirus warnings simply because the software came through Steam.
Warning signs such as a new or obscure developer, copied promotional art, an unusually attractive free game, external-download requests, unexpected PowerShell activity or new account-login alerts do not individually prove malware. They do justify stopping and verifying before execution.
What remains unknown
- How the attacker entered or modified the Chemia distribution process.
- How many users downloaded or launched the affected build.
- Whether Valve or the developer completed and publicly disclosed a forensic investigation.
- Which specific data, if any, was exfiltrated from confirmed victims.
- Whether the entry point was a developer account, build system, upload process or another mechanism.
The documented Chemia event occurred in July 2025. As of September 2026, it should be understood as a past incident—not presented as a new attack occurring now.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
