Table of Contents
Are Your OBS Studio Plugins Infected With Malware?
Recent Security Compromise on the OBS Forum
OBS Studio users recently faced a serious security threat. Malicious actors compromised the official OBS forum. They successfully inserted malware into three specific plugins over a period of several weeks. The core OBS streaming and recording software remains completely safe. The attackers bypassed the main application infrastructure entirely. They targeted individual plugin developers instead.
The Method Behind the Attack
The attackers utilized a straightforward credential stuffing technique. They obtained passwords previously compromised in other website data breaches. They tested these exact credentials on OBS forum developer accounts. This password reuse allowed the attackers to log in successfully. They then quietly replaced legitimate plugin files with malicious software. OBS administrators accurately classified this event as a low-skill, password reuse attack.
Identifying the Compromised Plugins
The attackers targeted three specific plugins. The malicious files only existed within the OBS forum’s Resource section. The GitHub repositories and the built-in OBS files remain clean. The affected plugins include:
- SRBeep: Compromised from February 8 through February 22.
- ClickSound: Affected between late January and late February.
- obs-websocket: Compromised during a brief window, resulting in roughly 80 infected downloads.
Required Actions to Secure Your System
You must take immediate action if you downloaded these specific files directly from the OBS forum recently. Check your computer for ClickSound versions 2026-02-28 or 1.0.1. Look for SRBeep versions 3.0.0 through 3.0.3. Verify if you installed obs-websocket versions 2026-02-28 or 5.0.2. You must delete these specific plugin versions immediately. Run a comprehensive malware scan on your computer afterward to ensure complete system safety.
Implemented Security Upgrades
OBS administrators quickly removed all affected files from the platform. They established strict new security protocols to prevent future incidents. Administrators must now manually approve all plugin updates before public release. Furthermore, developers must activate two-factor authentication (2FA) to post or modify any resources on the forum.
This incident reinforces a fundamental cybersecurity principle. You must use unique passwords for every online account. Secure your digital assets by updating any reused passwords immediately.