Subnautica 2 Fake Playtest Links Sent as Part of Malicious Campaign

Subnautica 2 developers raised the alarm on a malicious campaign trying to take advantage of players by tricking them into believing they were enrolling in a playtest. 

Subnautica 2, a game developed by Unknown Worlds Entertainment studio, is still in the works. A critical step in the development process is allowing players to get access to the game when it's not yet finished so the studio can make needed adjustments. 

Usually, a handful of players get access to the game, after the studio makes some announcement in advance. 

Malicious actors figured out this is a good way to trick people into accessing dangerous links, especially since Subnautica 2 is a highly anticipated game. 

According to a GamesRadar report, Steam players received invitations, seemingly from the actual game developers to join the playtest session. Of course, this never happens and companies don't reach out to individual players. 

"We've been made aware that fraudulent links to a Subnautica 2 playtest are being sent to our community on Steam. Please be aware that we will never contact anyone by Steam DM for any potential playtests. Stay safe out there, Subnauts!" said the developers on X. 

Surprisingly, this is a common attack vector targeting players on all platforms, not just Steam. Criminals often use any excuse to persuade people to click on links. They sometimes pretend to be admins for the platforms or, in this case, developers for a highly anticipated title. 

"Any contact regarding studies or playtests will only ever be sent by email from an Unknown Worlds address," also said community manager Donya Abramo on Discord. "Furthermore, while the devs recently invited players to sign up for a 'User Research Participant Pool,' the official link to it is only available on the Discord server. 

Of course, anyone who actually opened the links believing that they've been invited to play the latest Subnautica 2 build should change their passwords immediately and activate two-factor authentication if possible.