{"id":234866,"date":"2026-04-09T06:03:46","date_gmt":"2026-04-09T11:03:46","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/04\/project-zomboid-identifies-and-bans-over-a-dozen-steam-workshop-mods-containing-heavily-obfuscated-code-that-was-creating-malicious-files"},"modified":"2026-04-09T06:03:46","modified_gmt":"2026-04-09T11:03:46","slug":"project-zomboid-identifies-and-bans-over-a-dozen-steam-workshop-mods-containing-heavily-obfuscated-code-that-was-creating-malicious-files","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/04\/project-zomboid-identifies-and-bans-over-a-dozen-steam-workshop-mods-containing-heavily-obfuscated-code-that-was-creating-malicious-files","title":{"rendered":"Project Zomboid identifies and bans over a dozen Steam Workshop mods containing \u2018heavily obfuscated code\u2019 that was \u2018creating malicious files\u2019"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/project-zomboid-identifies-and-bans-over-a-dozen-steam-workshop-mods-containing-heavily-obfuscated-code-that-was-creating-malicious-files.jpg\"><\/a><\/p>\n<p>The exploit only affected Build 42 branches of Project Zomboid (the game\u2019s current \u2018unstable\u2019 testing release), so if you\u2019re on Build 41, you were \u201cnot vulnerable to this specific issue,\u201d the dev said. While The Indie Stone hasn\u2019t determined what the malicious files were actually doing, \u201cwe strongly recommend that anyone who downloaded them take appropriate security measures to ensure their system is safe. Simply uninstalling the mods is not sufficient.\u201d<\/p>\n<p>If you use mods in Project Zomboid, check them against the list below to determine if you\u2019ve downloaded and run any of these mods, which all look to be sound or music-related.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The exploit only affected Build 42 branches of Project Zomboid (the game\u2019s current \u2018unstable\u2019 testing release), so if you\u2019re on Build 41, you were \u201cnot vulnerable to this specific issue,\u201d the dev said. While The Indie Stone hasn\u2019t determined what the malicious files were actually doing, \u201cwe strongly recommend that anyone who downloaded them take [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42,1492],"tags":[],"class_list":["post-234866","post","type-post","status-publish","format-standard","hentry","category-media-arts","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/234866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=234866"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/234866\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=234866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=234866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=234866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}