Over the weekend on Steam Greenlight a single user cloned the entries for five games and reportedly used them to drive traffic to a known virus. Polygon has learned about the situation from an email claiming to be from one of the developers of a cloned game. The situation brings to light an unusual risk to the Greenlight program, both to teams hoping to gain exposure through the platform and to the potential fans of their games.
"Yesterday we saw our game duplicated on Greenlight," the anonymous email stated, "with a link attached [listing a] 'Beta Version' which is [in actuality a] malware link. So we reported that profile and game then we started to wait."
As of this morning, the email goes on, there has still been no direct response from Valve Software.
User "Bluebunny14" has no followers, no screenshots and no footprint on the Steam service as a whole. By and large, it appears to be a ghost account. Nonetheless, the account has five titles on Steam Greenlight, each of them clearly cloned from their original source material including screenshots and video trailers.
Bluebunny14's cloned games are not listed under concepts, so they've apparently paid Valve the one-time, $100 Greenlight fee to post cloned games alongside the originals.
So far only one of those IP holders, Cloud Runner Studios, appears to have issued a DMCA takedown notice related to its Steam Greenlight game Melancholy Republic.
Steam appears to have removed the offending links from each of the five cloned games' Greenlight pages, although those links still exist as part of the text description of each one. Commenters on each of the cloned games' pages state that the executable it leads to is, in fact, a known trojan and yet comments praising each cloned game continue to roll in.
All five cloned titles are still up for vote on the Greenlight service, which has the potential to cause confusion among voters.
Polygon has reached out to the teams behind the games involved, as well as Valve, for comment.
Update: Minutes after publication, Polygon confirmed that our initially anonymous tip came from the developers of The Maze, one of the team's whose Greenlight entry was cloned.
Update: As of this afternoon, all five cloned games have been removed from Steam Greenlight.
Update: Valve's Doug Lombardi responded to Polygon via email with the following statement. "Community members alerted us of the situation over the weekend by flagging the content. Our Community Moderators responded quickly by removing all malicious links from the fake Greenlight material and then we banned the submissions. We are taking further steps to deal with anyone involved in posting the links. We'd like to thank those who reported the issue in addition to our Community Moderators, and we encourage everyone to report any suspicious activity in the future by using the flag icon located throughout the Steam Community."
Verge Video from GDC 2015: Hands-on with Valve's steam controller