A threat actor called EncryptHub has compromised a game on Steam to distribute info-stealing malware to unsuspecting users downloading the title.

A few days ago, the hacker (also tracked as Larva-208), injected malicious binaries into the Chemia game files hosted on Steam.

Chemia is a survival crafting game from developer ‘Aether Forge Studios,’ which is currently offered as early access on Steam but has no public release date.

This is a crosspost

Unity is currently sending emails threatening longtime developers with disabling their access completely over bogus data about private versus public licenses. Their initial email (included below) contained no details at all, but a requirement to "comply" otherwise they reserved the right to revoke our access by May 16th.

When pressed for details, they replied with five emails. Two of which are the names of employees at another local company who have never worked for us, and the name of an employee who does not work on Unity at the studio.

I believe this is a chilling look into the future of Unity Technologies as a company and a product we develop on. Unity are threatening to revoke our access to continue development, and feel emboldened to do so casually and without evidence. Then when pressed for evidence, they have produced something that would be laughable - except that they somehow gathered various names that call into question how they gather and scrape data. This methodology is completely flawed, and then being applied dangerously - with short-timeframe threats to revoke all license access.

Our studio has already sunset Unity as a technology, but this situation heavily affects one unreleased game of ours (Torpedia) and a game we lose money on, but are very passionate about (Stationeers). I feel most for our team members on Torpedia, who have spent years on this game. Detailed Outline

I am Dean Hall, I created a game called DayZ which I sold to Bohemia Interactive, and used the money to found my own studio called RocketWerkz in 2014.

Development with Unity has made up a significant portion of our products since the company was founded, with a spend of probably over 300K though this period, currently averaging about 30K per year. This has primarily included our game Stationeers, but also an unreleased game called Torpedia. Both of these games are on PC. We also develop using Unreal, and recently our own internal technology called BRUTAL (a C# mapping of Vulkan).

On May 9th Unity sent us the following email:

Hi RocketWerkz team,

I am reaching out to inform you that the Unity Compliance Team has flagged your account for potential compliance violations with our terms of service. Click here to review our terms of service.

As a reminder - there can be no mixing of Unity license types and according to our data you currently have users using Unity Personal licenses when they should under the umbrella of your Unity Pro subscription.

We kindly request that you take immediate action to ensure your compliance with these terms. If you do not, we reserve the right to revoke your company's existing licenses on May, 16th 2025.

Please work to resolve this to prevent your access from being revoked. I have included your account manager, Kelly Frazier, to this thread.

We replied asking for detail and eventually received the following from Kelly Frazier at Unity:

Our systems show the following users have been logging in with Personal Edition licenses. In order to remain compliant with Unity's terms of service, the following users will need to be assigned a Pro license: 

Then there are five listed items they supplies as evidence:

An @ rocketwerkz email, for a team member who has Unity Personal and does not work on a Unity project at the studio
The personal email address of a Rocketwerkz employee, whom we pay for a Unity Pro License for
An @ rocketwerkz email, for an external contractor who was provided one of our Unity Pro Licenses for a period in 2024 to do some work at the time
An obscured email domain, but the name of which is an employee at a company in Dunedin (New Zealand, where we are based) who has never worked for us
An obscured email domain, another employee at the same company above, but who never worked for us.

Most recently, our company paid Unity 43,294.87 on 21 Dec 2024, for our pro licenses.

Not a single one of those is a breach - but more concerningly the two employees who work at another studio - that studio is located where our studio was founded and where our accountants are based - and therefore where the registered address for our company is online if you use the government company website.

Beyond Unity threatening long-term customers with immediate revocation of licenses over shaky evidence - this raises some serious questions about how Unity is scraping this data and then processing it.

This should serve as a serious warning to all developers about the future we face with Unity development.