The game in question, Block Blasters, has been removed from Steam, although it seems owners can still try to install it, but antivirus programs may block those attempts.

The GData linked in the post shows that the game was released in July 31 and that the malware update came in August 30, adding a .bat and 2 .zip files within the Engine/Binaries/ThirdParty/Ogg directory. The zip files were password protected, which blocked scanning.

The batch script checks first if the system is running only Windows Defender and does not have any of the listed AV products from AV_PROCESSES as a running process; if these criteria are met, the batch script unpacks the contents of the archive “v1.zip” (…) The script “1.bat” adds the destination folder of the executables found inside the “v3.zip” archive to the exemption list for Microsoft Defender Antivirus. [emphasis mine]

So, yeah, it’s pretty clear how easily it went undetected by Steam, Windows Defender or any other antivirus program - malware inside a password protected zip. I suspect making something similar on Android wouldn’t be much harder, as an app or game that needs access to your internal storage isn’t “too weird”, like something that asks for some music to play in a stage.