{"id":"steam-workshop-wallpaper-engine-malware-jun-2026","category":"supply-chain","status":"closed","title":"Malicious Wallpaper Engine wallpapers on Steam Workshop steal Steam accounts and install infostealers","tldr":"Kaspersky found dozens of booby-trapped Wallpaper Engine 'application' wallpapers on Steam Workshop, some with tens of thousands of downloads, carrying a backdoor and Lumma/Vidar infostealers. Valve removed them. Only install app wallpapers from creators you trust.","summary":"Kaspersky reported on 16 June 2026 that attackers had uploaded dozens of malicious 'application' wallpapers to Steam Workshop for Wallpaper Engine, the popular Windows wallpaper app. Application wallpapers can run programs, so malware was hidden in them, either bundled directly or inside password-protected archives. Payloads ran automatically after install. Kaspersky named the DarkKomet backdoor, a modified library that harvests Steam account details and hijacks sessions, the Lumma and Vidar infostealers and the RenEngine loader. In one test, a wallpaper launched a real game while malware ran in the background. Many wallpapers had thousands of downloads and some had tens of thousands. Kaspersky believes several independent groups were involved, mainly targeting Steam users in China and Russia, with victims also found in other countries. BleepingComputer reported that Steam removed all the wallpapers Kaspersky identified. This is not a software flaw, so there is no patch. Researchers expect new malicious uploads, and no change to Valve's rules was reported. Dates for when the campaign began vary between reports.","action":"If you use Wallpaper Engine, avoid 'application' wallpapers from unknown creators and don't open archives that come with passwords. If you installed any recently, run a full scan with reputable security software and change your Steam and other passwords from a clean device.","product":"Wallpaper Engine application wallpapers on Steam Workshop (Windows)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["steam","wallpaper-engine","steam-workshop","infostealer","lumma","vidar","supply-chain","gaming"],"affected":["Wallpaper Engine application-type wallpapers downloaded from Steam Workshop on Windows"],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Kaspersky discovered a malware campaign targeting Steam users through infected wallpaper","url":"https://www.kaspersky.co.uk/about/press-releases/kaspersky-discovered-a-malware-campaign-targeting-steam-users-through-infected-wallpaper","by":"Kaspersky","date":"2026-06-16"},{"kind":"news","title":"Steam Workshop abused to spread malware via Wallpaper Engine app","url":"https://www.bleepingcomputer.com/news/security/steam-workshop-abused-to-spread-malware-via-wallpaper-engine-app/","by":"BleepingComputer","date":"2026-06-16"},{"kind":"news","title":"Gamers beware — experts flag Steam Workshop is being abused to spread malware via Wallpaper Engine app","url":"https://www.techradar.com/pro/security/gamers-beware-experts-flag-steam-workshop-is-being-abused-to-spread-malware-via-wallpaper-engine-app","by":"TechRadar","date":"2026-06-16"}],"started":"2026-06-16","closed":"2026-06-16","created":"2026-11-03T21:26:14.315Z","updated":"2026-11-03T21:26:14.315Z","cve_notes":[],"timeline":[{"at":"2026-06-16","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"BleepingComputer reported that Steam had removed all the malicious wallpapers Kaspersky identified, and that researchers expect attackers to keep uploading new ones. No new Valve policy or restriction on application wallpapers was reported.","url":"https://www.bleepingcomputer.com/news/security/steam-workshop-abused-to-spread-malware-via-wallpaper-engine-app/","by":"BleepingComputer","patch":"na"},{"at":"2026-06-16","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"Kaspersky published research on dozens of malicious 'application' wallpapers on Steam Workshop for Wallpaper Engine, many downloaded thousands or tens of thousands of times, carrying account-stealing and infostealer malware. One sample dates from December 2025.","url":"https://www.kaspersky.co.uk/about/press-releases/kaspersky-discovered-a-malware-campaign-targeting-steam-users-through-infected-wallpaper","by":"Kaspersky","patch":"na"}],"url":"https://hard.fyi/live/steam-workshop-wallpaper-engine-malware-jun-2026/","json":"https://hard.fyi/api/live?id=steam-workshop-wallpaper-engine-malware-jun-2026"}