Steam Workshop Misused to Distribute Malware Through Wallpaper Engine

WHO:

TechRadar - Experts and researchers from cybersecurity company Kaspersky.

BleepingComputer - Threat actors abusing Steam Workshop.

WHAT:

BleepingComputer - Steam Workshop is being abused to distribute malware via the Wallpaper Engine app.

BleepingComputer - Infected wallpapers can lead to hijacking Steam accounts, compromising systems with a backdoor, or running cryptomining processes.

BleepingComputer - Kaspersky discovered dozens of malicious application wallpapers on Steam Workshop, each downloaded thousands or tens of thousands of times.

BleepingComputer - Malware is bundled directly in wallpaper packages or inside password-protected archives.

WHERE:

BleepingComputer - Steam Workshop, Valve's community hub for downloading game-related content.

WHEN:

BleepingComputer - Attackers have been exploiting this security gap since at least late 2025.

WHY:

BleepingComputer - Attackers exploit the security gap in the Wallpaper Engine desktop customization application to deliver malware.

HOW:

BleepingComputer - Malicious wallpapers execute automatically upon installation.

BleepingComputer - Kaspersky tested a wallpaper posing as a game called NTRaholic, which installed a backdoor file from the DarkKomet malware family in the background.

BleepingComputer - A custom version of 'AggregatorHost.dll' was installed to search for and steal Steam account credentials.

BleepingComputer - Multiple malware families were involved, including Lumma, Vidar infostealers, cryptocurrency miners, botnet loaders, RanEngine, and ransomware strains.

(UPDATED June 17, 2026 18:00 UTC)

Experts from cybersecurity company Kaspersky have uncovered a serious security issue on Steam Workshop, where attackers are exploiting the Wallpaper Engine app to distribute malware. This malware, which can hijack Steam accounts and compromise systems, is often bundled in wallpaper packages or hidden within password-protected archives, with some malicious wallpapers downloaded thousands of times. Kaspersky's investigation revealed that these threats have been active since at least late 2025, involving various malware families that can steal credentials and install dangerous backdoor files.