FBI traces Steam malware financier via Google cookies, Uber Eats

Federal agents arrested Zyaire Dontaevious Zamarion Wilkins, 21, at his North Lauderdale, Florida residence on July 14 after tracing funding and marketing for an alleged malware campaign on the Steam platform. A 15-page federal criminal complaint filed in mid-July charges him with one count of conspiracy to obtain information by computer for private financial gain.

Prosecutors say Wilkins provided launch and marketing funds while another participant created developer accounts and uploaded eight malicious games to Steam. The games were promoted on Discord, Telegram, X and LinkedIn. Messages included in the complaint discuss spending roughly $10,000 on a remote-access trojan, embedding malware inside games and using bots to target people with large cryptocurrency holdings. The filing identifies an alleged co-conspirator who reported that Wilkins provided funding in exchange for a share of stolen cryptocurrency and access to victims’ private information.

Investigators traced a Bitcoin address found in seized messages to a roughly $10,000 payment on the day it was used to collect funding. Records show the address sent payments to Bitrefill, where one account purchased more than 150 gift cards, including many for Uber Eats. That Bitrefill account was registered to an email that Google browser cookie data linked to other accounts, one of which used Wilkins’ initials and was associated with a student at the University of West Florida.

The complaint says a phone number tied to those accounts linked the trail to an email address containing Wilkins’ name, a Snapchat account that displayed his name, and a T‑Mobile account registered to a family address. Uber Eats records show the gift-card account placed more than 500 food-delivery orders from March 2024 through May 2026, spending over $9,000. Every order went to one of three locations: two addresses connected to the University of West Florida and Wilkins’ family home in North Lauderdale. Deliveries to the university addresses mainly occurred while classes were in session, and orders outside those periods went to the family address. The complaint does not assert that every payment or food order was funded with stolen money.

Agents executed a residential search warrant on July 8 and seized laptops, phones, other devices and three cryptocurrency wallet seed phrases. One recovered seed phrase corresponded to a Monero wallet with transaction activity totaling about 1,233 XMR, which the complaint values at roughly $382,000 in cumulative transfers. The filing notes that the $382,000 reflects transaction history, does not necessarily show a current balance and does not establish that all funds were stolen.

The complaint attributes the Steam campaign to eight malicious games that investigators say infected about 8,000 devices and accessed roughly 80 cryptocurrency wallets. Prosecutors estimate at least $220,000 in victim losses linked to the campaign. The case materials include device forensics, account records from multiple providers, location data, messaging and financial records to connect the funding and marketing operations to the accused.

Federal authorities have not described the roles of other identified participants beyond the allegations in the complaint. A representative for Wilkins did not respond to requests for comment. Wilkins is presumed innocent unless proven guilty.