People Playground Gets Hit by Malware for the Second Time in a Year, and This Attack Looks Much Worse
People Playground has been hit by malware for the second time in less than a year, and this latest attack looks considerably worse than the first. On September 21, players who launched the physics sandbox game with mods installed were exposed to a malicious Steam Workshop upload capable of wiping personal files and reading data from Discord, prompting solo developer mestiez to pull the game’s Workshop offline again and tell players to change their passwords as a precaution.
A Worm Disguised as a Workshop Mod
According to mestiez, the malicious code spread the same way it did in February: by self-publishing itself to the Steam Workshop through infected accounts, tricking other players into downloading it as a regular mod. This time, the payload was reportedly far more dangerous, with the potential to permanently delete personal files, read Discord usernames, and interfere with the game’s own Steam configuration and cloud data. Reports differ slightly on how early in the day the attack began, but the date itself, September 21, is consistent across every account.
People Playground’s Steam Workshop has now been disabled twice in 2026 after separate malware incidents.
The Developer Walked Back an Early Assurance
mestiez initially told players the malware hadn’t stolen passwords, tokens, or cookies, then retracted that assurance shortly after and urged anyone who played that day to change the passwords on their important accounts as a precaution, in case any session data had been exposed. “This is entirely my responsibility, and we gain nothing from throwing around rumors or speculations,” mestiez wrote, adding that it still wasn’t possible to say with certainty exactly what the program had done.
Not the First Time
This isn’t People Playground’s first brush with Workshop malware. Back in February 2026, a mod uploaded under the name FPS++ turned out to be a worm that wiped save files, achievements, control settings, custom maps, and player-made Contraptions, forcing the developer to disable the Workshop for roughly a week while a fix went out. That earlier incident stayed confined to in-game files rather than reaching outside the game itself, which is part of why this new attack’s reported access to Discord data and account information has alarmed players so much more.
What Players Should Do
The Steam Workshop for People Playground is offline again while mestiez investigates, and the developer’s advice for anyone who played the game on or around September 21 is straightforward: delete any installed mods, run an antivirus scan, and change the passwords on Discord and any other important accounts. As of this writing, neither Valve nor Steam has issued a separate statement on the incident.
Keep the adventure going! Check out more Gaming News on Gamersuniverse.
Picture Source: Studio Minus
