Distribution of Backdoor Malware with Legitimate Signature, Disguised as Steam Cleanup Tool

A malicious actor distributed a Trojans disguised as the SteamCleaner utility by modifying the original code, packaging it in a signed InnoSetup installer, and hosting it on multiple GitHub repositories and redirection pages commonly used for cracks/keygens. The installer executes added malicious code that runs an encrypted PowerShell payload to install Node.js and two Node.js backdoor scripts which persist via scheduled tasks and communicate with multiple C2 domains to accept and execute arbitrary commands; the report includes anti-sandbox checks, obfuscation details, sample MD5 hashes, URLs, and FQDNs.