Malicious Steam Workshop Wallpapers Deliver Malware and Steal Gamers’ Accounts
Summary
Kaspersky found dozens of malicious Wallpaper Engine packages on Steam Workshop. One investigated chain deploys malware and uses a modified AggregatorHost.dll to steal Steam credentials and hijack active sessions.
Key points
- Kaspersky found dozens of malicious application wallpapers on Steam Workshop; the article says each had thousands or tens of thousands of downloads.
- Packages delivered malware through bundled archives or password-protected archives, using executables, DLLs, or scripts that could run when a wallpaper was applied.
- One investigated sample drops Synaptics.exe, identified as part of DarkKomet, and launches the decoy game NTRaholic through ._cache_GAME1.exe.
- A modified AggregatorHost.dll searches for Steam credentials, hijacks the user's active Steam session, and sends collected data to an attacker-controlled server.
- Reported payloads include DarkKomet, Lumma and Vidar infostealers, the RenEngine loader, backdoors, crypto miners, and botnet loaders.
- Kaspersky reported that 89% of detected malicious download attempts were in China; Russia accounted for 5.5%.
- Steam had removed the identified wallpapers and links by publication, but Kaspersky said infected wallpapers continued to appear and recommended scanning them before use.
Article Details
- Attack Vectors
- Malicious application wallpapers shared through Steam Workshop contain executable files, DLLs, scripts, or archives that deliver malware when users select and apply them.
- Some wallpaper packages conceal payloads in password-protected archives, with the password placed in the archive name or a JSON configuration file.
- In one reported infection chain, the wallpaper drops Synaptics.exe and launches ._cache_GAME1.exe, which installs a modified AggregatorHost.dll that searches for Steam credentials and hijacks an active session.
- The compromised AggregatorHost.dll sends collected data to an attacker-controlled server; attackers can then use the hijacked account to upload additional malicious wallpapers.
- Defensive Notes
- The article recommends scanning application wallpapers with antivirus software before applying them.
- The article says the Steam team removed the identified malicious wallpapers and links, but warns that new infected wallpapers continue to appear.
- Kaspersky says its security solutions can detect and block the observed payloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 120[.]48[.]156[.]17 | Attacker-controlled server receiving collected data from the compromised AggregatorHost.dll. |
| URL | hxxp[:]//120[.]48[.]156[.]17/ey.php | C2 and data-exfiltration endpoint used to send collected Steam account and session data. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSome wallpaper packages hide malware in password-protected archives, with the password concealed in the archive name or a JSON configuration file.T1041 · Exfiltration Over C2 ChannelCollected Steam account and session data is sent to the attackers' server.T1071.001 · Web ProtocolsThe compromised AggregatorHost.dll sends collected data to the attackers' HTTP endpoint at hxxp://120.48.156[.]17/ey.php.T1105 · Ingress Tool TransferMalicious executables, DLLs, and scripts are delivered to victims inside wallpaper packages distributed through Steam Workshop.T1204.002 · Malicious FileUsers execute the malicious wallpaper packages by selecting and applying them.
Malware
Vendors
Products
SteamSince late 2025, attackers have abused Wallpaper Engine’s Steam Workshop sharing feature to hide malware in malicious wallpaper packages and target gamers in China and Russia for Steam account theft.Steam WorkshopSince late 2025, attackers have abused Wallpaper Engine’s Steam Workshop sharing feature to hide malware in malicious wallpaper packages and target gamers in China and Russia for Steam account theft.Wallpaper EngineSince late 2025, attackers have abused Wallpaper Engine’s Steam Workshop sharing feature to hide malware in malicious wallpaper packages and target gamers in China and Russia for Steam account theft.
Countries
CanadaRussia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).ChinaSince late 2025, attackers have abused Wallpaper Engine’s Steam Workshop sharing feature to hide malware in malicious wallpaper packages and target gamers in China and Russia for Steam account theft.GermanyRussia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).IndiaRussia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).RussiaSince late 2025, attackers have abused Wallpaper Engine’s Steam Workshop sharing feature to hide malware in malicious wallpaper packages and target gamers in China and Russia for Steam account theft.SingaporeRussia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).VietnamRussia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).