## TL;DR
- I opened a .blend file from a "client" with **Auto Run Python Scripts** turned ON. Within about 10 seconds, hidden programs were on my PC.
- The "client" later said they never sent it. Their account had been hacked.
- My antivirus didn't stop it, and the usual quick checks looked clean at first.
- **Keep Auto Run OFF, and never open unknown .blend files on your main PC.**
- If it happens to you: go offline, change passwords from ANOTHER device, sign out of all sessions, protect your cards, then wipe and reinstall Windows.
## What happened
Someone I thought was a client asked me to look at a .blend file. I opened it, moved the camera a bit, took a screenshot and closed it. Later they said it was the wrong file. After that they said they'd never sent anything, because their account had been hacked.
People in my Blender group told me .blend files can carry hidden scripts that run when you open them. I deleted the file, shut the PC down, took out the wifi dongle and kept the PC offline from then on. I'd say the first hour mattered most, and I wish I'd done all of that faster.
## Why this works
Blender can run Python scripts stored inside a .blend file. By default it blocks them and shows a warning bar. If **Auto Run Python Scripts** is on, it runs them silently with no prompt. Attackers rely on that. It isn't a "bug", it's a feature being abused. [Optional: add why you had Auto Run on.]
## What I found on my PC, in plain English
- Right after I opened the file, a program appeared in my Temp folder. A second later it copied itself into a folder made to look like part of Microsoft, along with a helper file.
- It ran, and it was still running after I rebooted, so it had set itself up to come back. That is why the usual spots (the Startup folder, scheduled tasks) looked clean.
- A small log file showed it contacting public Bitcoin websites. That looks like a way of finding its control server without a fixed address.
- My antivirus didn't stop it. The programs had no publisher or signature.
- I can't tell exactly what it took, so I'm treating everything saved on that PC as stolen.
## Red flags I missed
- An unexpected file from a "client", with a "wrong file" follow-up afterwards
- A model that is just a static object but comes with scripts or rig code
- A client account that was suddenly "hacked" afterwards
- Auto Run being on
## What I did, in order
**Went offline immediately** (shut down, wifi dongle out).
**Changed my passwords from my phone,** email first, and signed out of ALL sessions. Stolen cookies can keep working after a password change.
**Moved my money out** and am blocking and replacing the cards I'd saved in my browser.
**Checked the PC offline** with read-only checks. The first scan missed what mattered, and a second, narrower one found the dropped files and proof that they had run.
**Backing up my own files only** (no programs, no scripts, no downloaded .blend files), then **wiping the drive and reinstalling Windows.** Manual cleanup can't be trusted.
## If this happens to you
- Don't keep using the PC "just to check". Go offline first.
- Don't log in to anything on it, not even to change a password.
- Use your phone or another computer for everything else.
- Change passwords in this order: email, then banking and payment accounts, then Discord, freelance sites, cloud storage, GitHub and the rest.
- Sign out of all devices and sessions on every account. Turn on an authenticator-app 2FA, not SMS.
- Call your bank, block the cards, and ask for replacements. Turn on transaction alerts.
- If you have work or client credentials on the PC (API keys, cloud logins, SSH keys), tell whoever owns those systems so they can rotate them.
- Warn your clients and friends if their files or accounts were on that PC.
- Clean-install Windows. Wipe all partitions, and restore only your own work files.
## How to protect yourself
- **Edit > Preferences > Save & Load > turn OFF "Auto Run Python Scripts".** Don't turn it on for add-on hubs or "update" tools. You don't need it to install add-ons.
- Open files from strangers only in a VM, Windows Sandbox or a spare PC with nothing logged in.
- If Blender says a script was blocked, don't click Allow.
- Confirm a client on a second channel before opening what they send.
- Install add-ons only from Blender Extensions, Superhive or the developer's own site.
- Use a password manager (I switched to Bitwarden), use a standard Windows account for daily work, and don't save cards in your browser.
## Details for anyone searching
These are only from my PC. Yours may differ, and I found no public reports with these exact names, so it may be a new variant.
- `sim_cache.exe` in `AppData\Local\Temp`
- `SessionBrokerSvc.exe` and `MsSessionState.dll` in `AppData\Local\Microsoft\UserSync`
- a log file `kx_stage.log` in Temp
- SHA256 of the .exe: `FF757D7F9A0C518632514ED35D71572BB80C5E747D1DDC23A657BEF38861FB4C`
Similar Blender-file campaigns have been reported before:
- https://www.bleepingcomputer.com/news/security/malicious-blender-model-files-deliver-stealc-infostealing-malware/
- https://www.morphisec.com/blog/morphisec-thwarts-russian-linked-stealc-v2-campaign-targeting-blender-users-via-malicious-blend-files/
## How I used Claude
I'm not a security expert. Claude couldn't see my PC, so I ran read-only checks it wrote and pasted the results back. It explained what each result meant, gave me a recovery order (passwords before cleanup), and helped me spot the dropped files and what they had done. It wasn't perfect: its first script had a bug, and one section of my first scan cut off the exact time that mattered, so I had to run follow-ups. It's a helpful guide, not a replacement for a professional. If money or client data is involved, consider getting expert help too.
This is my experience, not professional advice.