{"id":54948,"date":"2025-12-10T12:58:20","date_gmt":"2025-12-10T17:58:20","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=54948"},"modified":"2025-12-10T12:58:20","modified_gmt":"2025-12-10T17:58:20","slug":"malicious-blender-model-files","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/malicious-blender-model-files\/54948\/","title":{"rendered":"Malware hiding in a 3D model"},"content":{"rendered":"

News outlets recently reported that a threat actor was spreading an infostealer through free 3D model files for the Blender software<\/a>. This is troubling enough on its own, but it highlights an even more serious problem: the business threat posed by free open source programs, uncontrolled by corporate infosec teams. And the danger comes not from vulnerabilities in the software, but from its very own standard features.<\/p>\n

Why Blender and 3D model marketplaces pose a risk<\/h2>\n

Blender is a 3D graphics and animation suite<\/a> used by visualization professionals across various industries. The software is free and open-source, and offers extensive functionality. Among Blender\u2019s capabilities is support for executing Python scripts, which are used to automate tasks and add new features.<\/p>\n

The package allows users to import external files from specialized marketplaces like CGTrader<\/a> or Sketchfab<\/a>. These platforms host both paid and free 3D models by artists and studios. Any of these model files potentially contain Python scripts.<\/p>\n

This creates a concerning scenario: marketplaces where files can be uploaded by any user and may not be scanned for malicious content, combined with software that has an Auto Run Python Scripts feature. It allows files to automatically execute embedded Python scripts immediately upon opening \u2014 essentially running arbitrary code on the user\u2019s computer in unattended mode.<\/p>\n

\u00a0<\/p>\n

How the StealC\u00a0V2 infostealer spread via Blender files<\/h2>\n

The attackers posted free 3D models with the .blend<\/em> file name extension on the popular CGTrader platform. These files contained a malicious Python script. If the user had the Auto Run Python Scripts feature enabled, downloading and opening the file in Blender triggered the script. It then established a connection to a remote server and downloaded a malware loader from the Cloudflare Workers domain.<\/p>\n

The loader executed a PowerShell script, which in turn downloaded additional malicious payloads from the attackers\u2019 servers. Ultimately, the victim\u2019s computer was infected with the StealC infostealer, enabling the attackers to:<\/p>\n