The Steam store is a beautiful, sacred thing, and not just because of all the sales. It’s a celebration of PC gaming, espousing community values and player-friendly policies. However, there’s an element of goodwill that makes it all tick, and bad actors breaking their end of the bargain can cause major issues for players. Beyond The Dark looked like an innocuous-enough indie horror game, but beneath the surface it was full of data-gobbling malware. While it has now been removed from Steam, I’m surprised that gaming the system seemed to be rather easy.
Beyond The Dark was originally released on Steam in December 2024. However, back then it had a different name, Rodent Race, different marketing materials, and, well, different gameplay altogether. It’s got a bit of a Phasmophobia vibe to it, which I’m sure would appeal to anyone looking for something spooky to play with pals. While it’s apparently the best part of 18 months old, the reality is that Beyond The Dark only came into existence a couple of weeks ago.
Looking at its SteamDB update history, we can see that Beyond The Dark gradually superseded Rodent Race over a short period, starting on May 4. Everything from top to bottom was changed. Steam games are initially reviewed before they’re accepted onto the store. However, as we’ve seen with previous malware games such as Chemia and PirateFi – two high-profile cases that have caught the FBI’s attention – bad actors begin injecting malignant code after they’ve gotten past the doorman.
As broken down by cybersecurity aficionado Eric Parker, Beyond The Dark cleverly disguised its true intentions, offering what looked like an entirely generic horror affair with one hand, while furiously grabbing at personal data with the other. Fortunately, it’s been reported sufficiently for Steam to take action, and the game is no longer available.
With the growing popularity of ‘vibe coding,’ whereby people create their own programs with the assistance of AI software like Claude, I can see there being an uptick in unscrupulous, malware-riddled games popping up on Steam. If it’s a case where all people need to do is upload a legitimate game, before injecting it with the bad stuff and updating the files once it’s passed review, then Valve’s own processes could eventually necessitate a rethink.
If anything, though, it’s a reminder to remain vigilant. You may think ‘this’ll never happen to me’ if you’re chronically online enough, but all it takes to get got is a single oversight. I doubt we’ll see some great surge in malware games any time soon, and to be honest, most of them look terrible anyway. If something seems too good to be true, like a free-to-play Phasmo knock-off, then it probably is.
