Market
Jun 16, 20261
69%
Malicious Steam Wallpapers Targeting Gamers in China and Russia with Account Theft and Malware

Malicious wallpapers distributed through Steam Workshop since late 2025 have been stealing Steam account credentials and infecting systems with malware targeting gamers in China and Russia. Attackers exploit Wallpaper Engine's application wallpaper feature, which allows arbitrary code execution, to distribute backdoors, ransomware, and crypto miners to tens of thousands of unsuspecting users.
Quick Facts
Who
Attackers/cybercriminals
What
Malicious wallpapers distributed through Steam Workshop
When
Since late 2025
Where
Steam Workshop
- Malicious wallpapers distributed through Steam Workshop
- Steam account credentials stolen
- Systems infected with backdoors, ransomware, and crypto miners
- Exploitation of Wallpaper Engine application wallpapers
- Two distribution methods: standard archives and password-protected archives
Since late 2025, a sophisticated malware campaign has been spreading through the Steam Workshop, exploiting Wallpaper Engine—a popular animated desktop wallpaper application with approximately 100,000 daily active users and nearly a million reviews. Attackers have uploaded dozens of malicious wallpapers that, when installed, steal Steam account credentials and infect systems with backdoors, ransomware, and cryptocurrency miners. The campaign primarily targets gamers in China and Russia.
Wallpaper Engine, available on Windows and Android, allows users to create and share four types of custom wallpapers: videos in MP4 or WebM formats, interactive scenes built in the app's editor, web pages powered by HTML and JavaScript, and executable applications that run as standalone programs on the desktop. The attackers have exploited the application wallpaper category—which essentially executes arbitrary code on users' computers—to distribute malware through Steam Workshop, where anyone can freely publish content without extensive security vetting.
Security researchers have identified dozens of infected wallpapers, each downloaded thousands or tens of thousands of times. The attackers employ two primary distribution methods: packaging malware alongside executable wallpapers in standard archives, or concealing malicious files within password-protected archives where users are tricked into entering credentials or scripts execute automatically. One sample discovered in December 2025 appeared as a functional game wallpaper but silently deployed a backdoor file called Synaptics.exe, part of the DarkKomet malware family, within minutes of installation.
Once executed, these compromised wallpapers hijack Steam credentials and introduce various threats including backdoors for remote system access, ransomware for file encryption, and crypto miners that degrade system performance. The reliance on Steam Workshop's open publishing model and the inherent execution privileges of application wallpapers created an attractive vector for cybercriminals targeting the global gaming community.
Topics
Why This Matters
This campaign directly threatens gamers' financial security and personal data. Compromised Steam accounts can lead to financial fraud, identity theft, and access to linked payment methods. The exploit of Wallpaper Engine's code execution capability demonstrates how legitimate applications can become infection vectors when distribution channels lack security controls. Users in China and Russia face particular risk, and the campaign's success (tens of thousands of downloads) suggests the vulnerability remains active and unpatched.
Timeline & Sources
Jun 16, 2026
WireKaspersky Securelist publishes detailed analysis of the malware campaign