Attackers used Steam Workshop uploads for the Wallpaper Engine app to trick Steam users into installing malicious wallpapers. Kaspersky says the abuse has been active since at least late 2025 and relies on Wallpaper Engine's 'application wallpaper' feature, which can run Windows executables as desktop backgrounds. Researchers found dozens of malicious uploads delivering DarkKomet, Lumma, Vidar, cryptominers, botnet loaders, RanEngine, and some ransomware, with some downloads reaching the thousands or tens of thousands before Valve removed the identified items.
Why it matters: This matters to Steam users because installing what looks like harmless custom content can lead to stolen game accounts or full device compromise. Users who installed Wallpaper Engine content from Steam Workshop should review their systems for malware, change Steam credentials, and be cautious with executable community uploads.
Bill Toulas
2026.06.16
100% relevant
This article establishes a distinct malware-distribution story centered on Steam Workshop and Wallpaper Engine, not a follow-up to an existing tracked event.
← Back to all stories