Steam game mod breached to push password-stealing malware

Downfall, a standalone fan build for Slay the Spire, was compromised on December 25 when attackers used a developer's hijacked Steam/Discord accounts to push a malicious update that delivered the Epsilon information stealer; the malware harvests browser credentials, cookies, payment data, Steam/Discord tokens and persists on Windows, putting users who installed the build during the breach window at risk.