When developers download assets from a marketplace, they expect 3D models, textures, and rigs, not malware. But that is exactly what happened to users of Fab.com, the asset marketplace operated by Epic Games. As known so far, 39 sellers unknowingly uploaded Autodesk Maya scene files infected with a self-replicating Python worm, which was then distributed to buyers before the issue was identified and addressed.

The incident is a reminder that no download platform, regardless of its reputation or the safeguards it has in place, can be considered fully risk-free. And it underlines a point that applies to every creative professional: a modern cybersecurity solution belongs on every machine you work on, including the ones you use for 3D work, animation, and design.

What happened: AV-Comparatives identified infected listings on Fab.com and notified Epic Games through a responsible disclosure process. Epic Games responded promptly, notified affected users, removed the listings, and deployed a new detection tool, resolving the issue well within the standard 90-day disclosure window.

What Fab.com Is and Who Uses It

Fab.com launched in late 2024 as Epic Games’ unified digital asset marketplace, consolidating the former Unreal Engine Marketplace, Sketchfab Store, and Quixel into a single platform. It serves game developers, 3D artists, and studios who rely on third-party assets (models, animations, environments, VFX, plugins) to speed up production workflows. Many of its users work with Autodesk Maya, one of the industry’s most widely used 3D animation and modeling applications.

The Malware: MEL/Vacphage.A, a Worm That Spreads Through Your Projects

The threat found in the affected listings is a Python script written as a self-replicating worm that specifically targets the Autodesk Maya environment. ESET has been detecting this threat as MEL/Vacphage.A since at least January 2021. Bitdefender detects it as Generic.MayaWorm.Phage.A, and Microsoft as Virus:Python/Vaccworm!MTB.

The worm’s origins have been documented publicly since 2021. A GitHub Gist by security researcher mottosso contains the full deobfuscated source code and an analysis of its behavior. The code header, written in Chinese, translates to: “This is only for internal use of the company. I will not be responsible for the impact if it is leaked.”. The author identifies themselves as “The indomitable and wise general.” This strongly suggests the script originated as an internal Maya environment protection tool inside a Chinese studio, one that was later leaked, repurposed, and began spreading as a worm through shared scene files across the 3D art community worldwide. What started as a studio-internal cleanup script became, through leakage and propagation, one of the most persistent threats in the Maya ecosystem.

How the Infection Works

The affected files are Maya Binary (.mb) files, compiled 3D scene files that Maya loads directly. Forensic analysis of a confirmed sample reveals the following infection chain:

Step 1: Initial compromise. When a user opens or runs the infected .mb file, the embedded Python script executes immediately. It overwrites userSetup.py, a legitimate Maya startup script that runs automatically every time Maya launches. It also drops a file called vaccine.py into the Maya scripts folder. The naming is deliberately ironic: the “vaccine” is itself the virus.

Step 2: Persistence. From this point on, every time Maya starts, userSetup.py launches vaccine.py in the background, without any notification to the user.

Step 3: Propagation. vaccine.py inspects every Maya scene file the user opens or creates and embeds a copy of the malicious code into it. The worm is now part of that project file. If that file is sent to a colleague, uploaded to a shared drive, or committed to version control, the next person who opens it becomes infected.

Step 4: Silent spread. There is no visible indication of infection during normal operation. The worm propagates quietly across a studio’s entire Maya project library and into any Maya files shared with collaborators, clients, or outsourcers.

AV-Comparatives’ own forensic analysis of the infected file confirms this behavior directly. Opening the Maya Binary in a hex editor at offset 0x000AC680 reveals the embedded Python code in plain text within the compiled binary, including the characteristic strings petri_dish_gene, cmds.internalVar(userAppDir=True), userSetup.py, import vaccine, leukocyte = vaccine.phage(), leukocyte.occupation(), and cmds.evalDeferred. These are the exact function calls and variable names that implement the worm’s self-replication and persistence mechanism, visible without any special tooling directly inside what appears to be an ordinary 3D scene file.

What AV-Comparatives Found, and What Epic Games Confirmed

AV-Comparatives researchers identified several product listings on Fab.com containing Maya Binary files infected with MEL/Vacphage.A, including listings by seller “mr3dartist”:

• “Modern Upholstered Armchair”, published 16 June 2025
  

  

• “Industrial Stainless Steel Oxygen Cylinder Trolley”, published 10 March 2025
  

  

The seller profile and upload pattern are consistent with a small independent creator who unknowingly uploaded infected scene files, a conclusion that aligns with Epic Games’ own investigation.

In a statement provided to AV-Comparatives, Scott Miller, Senior Director of Information Security at Epic Games, confirmed the scope of the issue: “Through a security review of published products, we discovered assets on Fab contained Maya files with MEL/Vacphage.A. From our analysis, we identified that 39 sellers unknowingly uploaded the files as part of their products to Fab, and there was no compromise of Epic’s systems, servers, or any customer information.”

How Epic Games Responded

After being informed by a user and starting our investigation, AV-Comparatives followed responsible disclosure principles throughout this process, contacting Fab.com via LinkedIn (due to the lack of visible contact information on fab.com) on 7 May 2026 and submitting a formal disclosure to Epic Games on 15 May 2026. While there was no response on LinkedIn, Epic Games confirmed receipt and initiated a formal response on the same day. Their prompt and constructive engagement meant that concrete improvements for Fab store users were achieved well within the standard 90-day responsible disclosure window.

According to the statement from Scott Miller, Epic Games took the following steps after discovering the infected files:

Their first action was to contact affected buyers directly and point them to Autodesk’s free cleanup tool. The affected listings were subsequently unpublished from the marketplace. Because Fab products can include multiple file formats in addition to Maya, the infected files were replaced with placeholders to minimize disruption to artists using other formats. Sellers were also notified and asked to republish their products with clean files.

On the scanning side, Epic Games stated that Fab scans all uploaded files for viruses using industry-standard malware detection, but that this particular virus was not flagged because it affects each file uniquely. A new detection tool was built and deployed on 26 May 2026 specifically to catch these infected files going forward.

It is worth noting that AV-Comparatives’ screenshots from 15 May 2026 still showed the listings as active and downloadable. The unpublishing and replacement of files therefore took place at some point between that date and the deployment of the new scanning tool on 26 May 2026. The warning email sent to affected buyers was dated 1 May 2026, meaning buyers were notified of the issue several weeks before the listings were fully removed. We’d like to express our opinion, that the wording was somewhat unlucky, as the mail only says “This is a script that can disrupt Maya’s performance.” without mentioning the nature of the worm.

[Editor’s note: In an earlier version of this article, we stated that sadly Fab.com didn’t include the link to the Autodesk Security Tools, which was false. The mail we had been provided with at the beginning of our investigation most likely had “lost” the link during the conversion from HTML to Text based. We thank Epic Games for correcting us and providing us with a screenshot of the mail that had been sent out originally (see above). We’d like to apologize for any confusion.]

Detection Rates: Why Endpoint Protection Matters on Creative Workstations

The specific sample from the Fab.com listings has been on VirusTotal since April 2022 and is currently detected by 30 out of 61 engines, among them Bitdefender, ESET, Gen Digital and Microsoft. ESET first added detection for the embedded Python script in January 2021.

That figure illustrates something important. Even a well-known threat in circulation for years may not be detected by every product, while general coverage is good. The reasons vary due to the way and stage a scan is performed, and coverage for file types outside the typical Windows executable category can lag behind. This is also why independent testing matters, and why product selection based on verified test results is worthwhile.

Many creative people refrain from installing Cybersecurity solutions due to a fear of drained resources, but the performance argument against installing security software on a creative workstation no longer holds up to scrutiny. The AV-Comparatives Performance Test (April 2026) demonstrates that today’s top-rated security products have a minimal measurable impact on everyday tasks including file operations, application launch times, and rendering workflows. The tools that detect threats like MEL/Vacphage.A are the same ones that score well on performance. There is no meaningful trade-off to be made.

A Broader Lesson for Everyone

The Fab.com incident is not unique to one marketplace or one file format. It reflects a broader challenge that affects every platform where user-generated content is shared and distributed at scale.

Malware embedded in creative file formats, including 3D scene files, scripts, plugins, and templates, is a growing attack surface that standard endpoint scanning does not always cover as thoroughly as executable files. Artists, designers, animators, and developers often download dozens of assets from multiple sources as part of their normal workflow. The assumption that a trusted platform equals a safe file is one that this incident directly challenges.

Who Is at Risk

Any developer or artist who:

• Uses Autodesk Maya and has downloaded assets from Fab.com before 26 May 2026
• Has received .ma or .mb files from collaborators
• Works in a shared studio environment where Maya project files are passed between machines

…should treat their Maya installation as potentially compromised until verified.

The worm’s self-propagating nature means that a single infected download can contaminate an entire project library’s Maya files and spread to anyone the files are subsequently shared with. In a studio setting, the exposure surface can grow quickly and silently.

What Affected Users Should Do

1. Run Autodesk’s official Security Tools for Maya. Autodesk has published a dedicated cleanup tool available at the Autodesk App Store. It detects and removes the ScriptNode exploit, vaccine.py, and associated modifications to userSetup.py. Autodesk strongly recommends installing this tool as a persistent safeguard, not just a one-time cleanup measure.
2. Scan with a reputable endpoint security product. Modern security software detects MEL/Vacphage.A and related variants. Users concerned about performance impact should consult the AV-Comparatives Performance Test (April 2026)
3. Audit shared and received files. Any .mb or .ma files received from third parties, downloaded from Fab.com, or shared within a team should be treated as suspect until scanned. Do not open unverified Maya files on a clean machine before scanning them.
4. Check userSetup.py and your Maya scripts folder. Look for unexpected entries in userSetup.py (typically Documents/maya/<version>/scripts/) and for the presence of vaccine.py in the same folder. Their presence is a reliable indicator of infection.

Summary

• Fab.com hosted Maya Binary files infected with MEL/Vacphage.A across 39 known sellers. The sellers themselves unknowingly uploaded the infected files. No Epic systems or customer data were compromised.
• The worm overwrites Maya startup scripts and embeds itself in every Maya project file opened on an infected machine, spreading silently to collaborators who later open those files.
• Multiple security vendors have independently classified this threat since 2021. 30 out of 61 engines on VirusTotal currently flag the confirmed sample, first submitted in April 2022.
• AV-Comparatives followed responsible disclosure principles and notified Epic Games on 15 May 2026. Epic Games responded promptly: affected buyers were notified, listings were unpublished, and a new detection tool was deployed on 26 May 2026, well within the standard 90-day disclosure window.
• The incident illustrates that trusted platforms are not immune to malware in creative file formats, and that endpoint security on creative workstations is not optional, but that stores have a fair share in responsibility, too.
• Affected users should run Autodesk’s Security Tools for Maya and scan with an up-to-date security product.

Thomas Uhlemann, Cybersecurity Evangelist