- Incident: A malicious "FPS++" mod for People Playground functioned as a self-propagating worm.
- Impact: Wiped user configurations, local saves, and Steam achievements while hijacking accounts to spread the infection.
- Status: The developer (Studio Minus) patched the exploit and re-enabled the Steam Workshop as of February 6, 2026.
- The "Fakeout": The mod spoofed performance gains by multiplying the in-game FPS counter to hide its background activity.
The "FPS++" Worm: A Script Kiddie’s Masterpiece
In a move that feels like a throwback to early 2000s malware, People Playground was recently hit by a "worm" mod disguised as a performance optimizer. We’ve seen mod-based exploits before, but this "FPS++" upload was particularly nasty because of how it weaponized the victim's own Steam account. Once you enabled the mod, it didn't just sit there; it started scanning every Workshop item you’ve ever published, edited them silently, and re-uploaded them with the malicious code attached. It even created entirely new public Workshop items under your name to keep the infection chain moving.
Our take? This is a massive wake-up call for anyone who blindly clicks "Subscribe" on utility mods. The developer, mestiez, noted that the mod went as far as "silently voting and favoriting" itself to climb the Workshop rankings. It’s a classic social engineering trick—using fake social proof to trick the next victim.
Total System Wipe: Your Progress is Gone
The damage wasn't just limited to your Steam profile’s reputation. The malware essentially performed a scorched-earth operation on your local game files. According to the developer’s security breakdown, the mod "resets your steam stats for the game, such as achievements... also deletes configs, control schemes, stats, caches, maps, contraptions, and prefs."
To add insult to injury, the mod creator had a sense of humor. The mod faked its efficacy by "multiplying the fps counter" to make users think their game was actually running smoother while their data was being nuked in the background. The developer was blunt about the aftermath: "everything—except achievements—are completely gone and unrecoverable." If you lost your achievements, you’ll have to use third-party spoofing tools to get them back, a move the dev admits is "technically cheating," but justifiable given the circumstances.
Steam’s Ongoing Security Headache
We’ve been tracking these Workshop vulnerabilities for years. Whether it was the 2022 Cities: Skylines mod scare or the 2024 DLL hijacking in Cities Skylines 2, the Steam Workshop remains a prime target for bad actors. Valve pushed security changes in late 2023 to combat this, but as this People Playground incident proves, there are still holes in the fence.
Timeline of the Fix
- February 1st: Developer disables the Steam Workshop entirely to stop the spread.
- February 4th: A security update is deployed to harden the game’s mod-loading logic and prevent "shady code" execution.
- February 6th: Steam Workshop functionality is restored for all users.
While the developer has patched the hole, the "FPS++" incident serves as a grim reminder. Even in a sandboxed environment like Steam, a malicious mod can still act as a wrecking ball for your save data. If you aren't auditing what you're installing, you're playing digital Russian Roulette.
Common Questions
- What did the malicious FPS++ mod do to People Playground players?
- The mod functioned as a self-propagating worm that wiped user configurations, local saves, and Steam achievements while hijacking accounts to spread the infection to other Workshop items.
- Is the People Playground Steam Workshop safe to use now?
- Yes, the developer Studio Minus patched the exploit and re-enabled the Steam Workshop as of February 6, 2026.
- How did the FPS++ mod hide its malicious activity?
- The mod used a 'fakeout' technique where it spoofed performance gains by multiplying the in-game FPS counter, tricking users while it performed background tasks.