Steam tightening up developer security with SMS verification following malware hacking attack

12.10.2023 - 14:03 / eurogamer.net / Liv Ngan

Valve is introducing SMS verification for developers as part of its new security measures on Steamworks. This follows earlier incidents of hackers taking over several developers' accounts on the platform, where they added malware to various game builds.

These attacks, which were verified by PC Gamer, only affected less than 100 Steam users, although NanoWar: Cells VS Virus (pictured above) developer Benoît Freslon recently revealed the hackers had taken control of his browser access tokens. This essentially gave the hackers access to any service Freslon had been logged into.

«I just used my dev account to release the game few hours before the hack I suppose,» he shared on X (formerly Twitter).

Thankfully, Steam is now taking action to prevent such an occurrence happening again.

In a new post, Valve said it was implementing changes to how builds are managed in Steamworks (the platform's free suite of tools which developers can use to integrate Steam's functions into their products), as well as when developer's add new users into their Steamworks group.

These changes will require a phone number to be associated with a user's Steamworks account, so that Steam can send confirmation messages to developers when they want to set a game build live.

«For any released app, if you want to update a build to the default branch, Steam will text you a confirmation code,» Steam explained. «You will need to enter this code in order to set the default branch. Note that you will not need a code if your app is not yet released, or if you are updating a beta branch.»

The same will also apply when Steamworks admins want to invite others to their group. There will now be a two-factor authentication process. As well as email verification, the admin inviting a new member will need to enter an SMS code before they can send their invitation out.

These changes will be implemented from later this month, on 24th October. «So be sure to add a phone number to your account now,» Steam advised, adding it also plans on «adding this requirement for other Steamworks actions» at some point in the future.

More information can be found on the Steam blog.

Hey Simon, I'm the developer of this game. ALL my accounts were hacked by a Token Grabber Malware. Unfortunately, the 2FA i s useless if the token is still active. I just used my dev account to release the game few hours before the hack I suppose.

While we are on the subject of Steam, Steam Next Fest is currently in full swing.

Eurogamer contributor Liv Ngan recently tried out Crime Scene Cleaner, which has a demo out as part of Next Fest. You can read their thoughts about this bloody take on PowerWash Simulator here.