People Playground has had its Steam Workshop support switched off after a second malicious mod in a year, and the sandbox game’s developer is telling players to treat any recent modded session as compromised. In a Steam news post on September 22, Studio Minus said it had disabled the Workshop "quite a few hours" earlier "due to yet another malicious mod", adding that "this one is especially bad".
The developer asked anyone who played People Playground with mods between 6pm and 8pm CEST on September 21 to run an anti-virus scan, delete everything in their mods folder, and leave the game closed until the studio announces it is safe to open. According to the post, the malware can permanently wipe a considerable amount of personal data, vandalise a player’s Steam configuration and the Steam cloud saves of other games, and publish personal information taken from a Discord account to the Workshop.
The advice on credentials has since hardened. Studio Minus initially wrote that the malware "DOES NOT steal your passwords, tokens, cookies, or other credentials", then struck that line out and told players to change the passwords of all their important accounts in order to invalidate any session tokens that might have been caught up in it, with Discord singled out as the priority. A redditor who inspected the mod claims it hijacks the user’s Steam account to republish itself on the Workshop alongside the user’s personal information and files from People Playground and other installed Steam games, and sends slurs to the account’s Steam friends; Studio Minus has not confirmed that account.
The studio has since released a build of People Playground that prevents mods from running at all. On its Discord, Studio Minus said Workshop and mod support will only return if mods are "fundamentally safe to run", which "might never happen". Asked who was behind the mod, the developer declined to speculate: "This is entirely my responsibility, and we gain nothing from throwing around rumours or speculations."
The second outbreak this year
This is the second time in 2026 that People Playground has been hit this way. In February, a malicious Workshop mod tampered with affected players’ files, contraptions folders and mod lists, and the Workshop was temporarily disabled then too. In a blog post last month, the game’s primary developer described People Playground as a "technical hellscape" that makes it technically impossible to properly sandbox mods in their current state, and called the effort to keep ahead of malicious uploads a "hopeless arms race".
PC Gamer counts at least three other Steam Workshop malware incidents in 2026 besides these: malicious Project Zomboid mods in April, virus-carrying wallpapers in Wallpaper Engine in June, and infected Meccha Chameleon maps in July that were followed by that game’s Discord being hacked.
