The developers of Project Zomboid have issued a serious warning after multiple Workshop mods were found to be capable of creating malicious files outside the game’s own folders. According to The Indie Stone, the affected content has now been removed and the uploader has been banned, but anyone who downloaded those mods is being told that simply uninstalling them is not enough and that their system should be checked properly.
According to the studio, the investigation began after players reported that certain Steam Workshop modifications appeared to generate malicious code when run. Once the developers looked into the issue, they confirmed that 14 mods from the same user contained heavily obfuscated code capable of creating files outside the Project Zomboid directory. The team’s estimate is that these uploads may have ended up on anywhere between 500 and 2,200 devices. What makes the situation more concerning is that the full scope and exact behavior of the malicious files still have not been completely determined.
The Indie Stone also stressed that the actual problem is not the main True MooZIC mod itself, which it says is completely free of malicious code. The issue came from add-ons built on top of that system and uploaded by the same bad actor. That user has now been banned and can no longer publish anything on the Workshop, while all affected items have been removed. Even so, anyone who installed them is being urged to take the situation seriously instead of treating it like a routine mod cleanup.
List of the Affected Mods
- Risk of Rain 2 OST (True MoooZIC) – Workshop ID: 3681934105 – Mod ID: RiskOfRain2Music
- Risk of Rain 1 OST (True MoooZIC) – Workshop ID: 3681810963 – Mod ID: RiskOfRain1Music
- NieR: Automata OST (True MoooZIC) – Workshop ID: 3681765529 – Mod ID: NierAutomataMusic
- Katana ZERO OST (True MoooZIC) – Workshop ID: 3681764942 – Mod ID: KatanaZeroMusic
- Persona 5 OST (True MoooZIC) – Workshop ID: 3681756112 – Mod ID: Persona5Music
- Jujutsu Kaisen S1 OST (True MoooZIC) – Workshop ID: 3681755051 – Mod ID: JujutsuKaisenMusic
- Hotline Miami 2: Wrong Number OST (True MoooZIC) – Workshop ID: 3681719339 – Mod ID: HotlineMiami2Music
- Hotline Miami OST (True MoooZIC) – Workshop ID: 3681718339 – Mod ID: HotlineMiami1Music
- Silent Hill OST (True MoooZIC) – Workshop ID: 3681477980 – Mod ID: SilentHillMusic
- Cowboy Bebop OST (True MoooZIC) – Workshop ID: 3681476976 – Mod ID: CowboyBebopMusic
- Metal Gear Rising: Revengeance Vocal Tracks (True MoooZIC) – Workshop ID: 3681339955 – Mod ID: MGRRevengeanceMusic
- Classic Roblox Music (True MoooZIC) – Workshop ID: 3681335952 – Mod ID: RobloxClassicMusic
- DELTARUNE Ch3+4 Music (True MoooZIC) – Workshop ID: 3681334251 – Mod ID: DeltaruneCh34Music
- Minecraft Alpha+Beta OST (True MoooZIC) – Workshop ID: 3680972796 – Mod ID: MinecraftClassicMusic
The developers say the exploit itself only affected the Build 42 branch of Project Zomboid. At the same time, while reviewing that version, they also discovered a separate vulnerability unrelated to this mod incident, one that had not yet been exploited, and prepared a patch for it before anyone could take advantage of it. So this was not just a case of removing a bad set of uploads, but also part of a broader security response around the game’s current testing branch. None of that changes the immediate recommendation, however: if one of these mods was on your machine, you should not assume you are safe just because it is now gone from the Workshop.
The Indie Stone explicitly says that uninstalling the mods is not enough. Because the affected items were able to create files outside the game directory, the studio is recommending that users take appropriate security steps to make sure their systems are actually clean. Put simply, if you used any of these mods, this is no longer a case of clicking unsubscribe and moving on – it is a case of checking your PC properly.
Source: The Indie Stone / Steam, 3DJuegos
