Prosecutors in the U.S. have charged a man from Florida for uploading counterfeit video games with embedded malware onto Steam, the widely used PC gaming platform. According to a criminal complaint, once users downloaded and installed these games, the malware was intended to compromise their computers, harvest passwords and sensitive information, and siphon off cryptocurrency from their wallets.

The FBI apprehended Zyaire Wilkins, a 21-year-old student from Florida, on Tuesday. The following day, prosecutors accused him along with several unidentified co-conspirators of engaging in hacking activities. For the last two years, Wilkins and his colleagues allegedly released multiple malware-infected video games on Steam, such as BlockBlasters, Dashverse, Lampy, Lunara, and PirateFi. According to the FBI, around 8,000 victims were compromised using the malware, which resulted in hacking about 80 cryptocurrency wallets and stealing over $220,000 in crypto.

Authorities reported that Wilkins and his associates promoted their malicious video games through Discord, LinkedIn, and Telegram.  

Wilkins’ attorney did not reply to a request for comment. 

In March, the FBI disclosed it was probing a hacker suspected of utilizing video games with embedded malware published on Steam for the purpose of hacking victims. The bureau urged individuals who had downloaded the harmful games mentioned in this week’s complaint to come forward and provide information to assist the investigation. 

Over the past year, Valve, the creator of Steam, has removed numerous video games after they were discovered to harbored malware, including PirateFi. All these games were crafted to appear legitimate, allowing players to install and play them, despite containing malware. 

Following the FBI’s identification of another individual implicated in the crimes, the complaint notes that federal agents conducted an interview. This unnamed individual stated they collaborated with others to generate funds for launching and promoting the malicious games in exchange for a share of the stolen cryptocurrency. A specific crypto account tied to the operation was identified by the FBI, which traced cryptocurrency transactions from that account used to purchase various gift cards, including ones for Uber Eats. After obtaining a subpoena from Uber, federal agents found that these gift cards were associated with an account used for deliveries to Wilkins, known online as Sibel.eth, according to the complaint. 

Subsequently, the feds obtained a search warrant for Wilkins’ home, where they confiscated his MacBook, cell phones, additional devices, and digital wallets. As stated in the complaint, he declined to speak or respond to any inquiries.