Although less than a hundred users have installed the affected games, Valve has introduced a new security measure.

Several game developers’ Steam accounts have been attacked and their games have been updated with malware. With less than a hundred users having installed the affected games, Valve notified them of the attack via email, and Gabe Newell’s company confirmed the situation, according to Simon Carless, founder of the GameDiscoverCo newsletter and PCGamer also received confirmation.

Valve has taken action despite the fact that the malware has not been particularly successful in spreading. As of October 24, game developers will be required to go through 2FA, or two-factor identification, before updating the standard content branch of a game they have already released (the branch that automatically updates the game for users who have installed it). This will require a phone, and for those who don’t have one, Valve is shrugging its shoulders because they’ll have to receive some sort of SMS if they want to continue updating their games…

The company told PCGamer that the extra friction for partners is a necessary evil to protect Steam users, while also notifying developers that their accounts are in some way at risk. They added that there has been a recent increase in sophisticated attacks, and that developers who publish their products on Valve’s digital store are being targeted.

SMS authentication will not only be mandatory for game updates, as Steam partners will also need to use short SMS codes to add more users to their group, and two-factor authentication is planned for other backend operations (i.e. actions that users cannot access but developers can).

One of the games involved was NanoWar: Cells vs. Virus. Its developer, Benoît Freslon, wrote on Twitter that the malware had stolen his browser access tokens, giving attackers temporary access to everything he was logged into…

Source: PCGamer