Cybercriminals have exploited Wallpaper Engine, a live wallpaper application on Steam, to distribute malware through Steam Workshop since late 2025. Attackers embed malicious code within wallpapers that deliver multiple malware families such as infostealers, backdoors (including DarkKomet), crypto miners, and ransomware. The malware modifies system libraries to identify Steam installations and exfiltrate user credentials and data to attacker-controlled servers. Hijacked Steam accounts are subsequently used to upload further malicious wallpapers, facilitating ongoing distribution. The presence of diverse malware families suggests multiple independent threat actors are leveraging this method. The majority of infections (89%) have occurred in China, with additional infections in Russia and other countries. Thousands of users downloaded infected wallpapers before their removal from the platform.

The malware compromises user systems by stealing Steam account credentials and other sensitive data, enabling attackers to hijack accounts and propagate further malware via Steam Workshop. Infection can lead to unauthorized access to gaming accounts, potential financial loss, and exposure to additional malware such as ransomware and crypto miners. The modification of system libraries to locate Steam installations facilitates stealthy data exfiltration. The widespread infection, especially in China, indicates significant risk to users of Wallpaper Engine on Steam.

No official patch or fix is available as this is a malware distribution campaign exploiting user-generated content. Users should avoid downloading wallpapers from untrusted or unknown sources on Steam Workshop. Steam users should enable multi-factor authentication (MFA) on their accounts to reduce the impact of credential theft. Regularly review and remove suspicious wallpapers and monitor account activity for unauthorized access. Steam and Wallpaper Engine users should keep their software updated and follow vendor guidance. Since this is a distribution method abuse rather than a software vulnerability, remediation depends on user vigilance and platform content moderation. Check Steam and Wallpaper Engine advisories for any updates or mitigation recommendations.