Malicious Steam Workshop Wallpapers Used to Deliver Malware
Summary
Kaspersky says malicious Wallpaper Engine wallpapers on Steam Workshop delivered backdoors and other malware, including tools that stole Steam credentials. Steam removed the identified uploads, but researchers warn more may appear.
Key points
- Kaspersky says attackers have uploaded dozens of malicious application wallpapers since at least late 2025; some were downloaded thousands or tens of thousands of times.
- Malicious payloads were bundled in wallpaper packages or password-protected archives and reportedly executed when users installed the wallpapers.
- In a test, a wallpaper posing as the game NTRaholic appeared to launch normally while installing a DarkKomet backdoor.
- Researchers say a custom AggregatorHost.dll file searched computers for Steam accounts and stole account credentials.
- Other observed payloads included Lumma and Vidar infostealers, cryptominers, botnet loaders, RanEngine, and ransomware.
- Steam removed the malicious wallpapers identified by Kaspersky; researchers warned that new uploads may follow and recommended scanning downloads with up-to-date antivirus software.
Article Details
- Event Type
- Malware distribution through malicious wallpaper packages uploaded to Steam Workshop and executed via Wallpaper Engine.
- Impact
- The malicious packages have been used to install the DarkKomet backdoor, steal Steam credentials, and deliver Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and ransomware. Kaspersky reported that some identified wallpapers had been downloaded thousands or tens of thousands of times. Steam removed the malicious wallpapers identified by Kaspersky, but researchers warned that attackers may submit new ones.
MITRE ATT&CK
Malware
DarkKometThese infected wallpapers have been used to steal Steam credentials, deploy backdoors like DarkKomet, and run other threats including Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and ransomware.LummaThese infected wallpapers have been used to steal Steam credentials, deploy backdoors like DarkKomet, and run other threats including Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and ransomware.RanEngineThese infected wallpapers have been used to steal Steam credentials, deploy backdoors like DarkKomet, and run other threats including Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and ransomware.VidarThese infected wallpapers have been used to steal Steam credentials, deploy backdoors like DarkKomet, and run other threats including Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and ransomware.
Vendors
Products
SteamThreat actors are abusing Steam Workshop and Wallpaper Engine to hide malware inside malicious wallpaper packages that users download from Valve’s platform.Steam WorkshopThreat actors are abusing Steam Workshop and Wallpaper Engine to hide malware inside malicious wallpaper packages that users download from Valve’s platform.Wallpaper EngineThreat actors are abusing Steam Workshop and Wallpaper Engine to hide malware inside malicious wallpaper packages that users download from Valve’s platform.