Malicious Wallpaper Engine wallpapers on Steam Workshop steal Steam accounts and install infostealers
Kaspersky found dozens of booby-trapped Wallpaper Engine 'application' wallpapers on Steam Workshop, some with tens of thousands of downloads, carrying a backdoor and Lumma/Vidar infostealers. Valve removed them. Only install app wallpapers from creators you trust.
If you use Wallpaper Engine, avoid 'application' wallpapers from unknown creators and don't open archives that come with passwords. If you installed any recently, run a full scan with reputable security software and change your Steam and other passwords from a clean device.
What’s happening
Kaspersky reported on 16 June 2026 that attackers had uploaded dozens of malicious 'application' wallpapers to Steam Workshop for Wallpaper Engine, the popular Windows wallpaper app. Application wallpapers can run programs, so malware was hidden in them, either bundled directly or inside password-protected archives. Payloads ran automatically after install. Kaspersky named the DarkKomet backdoor, a modified library that harvests Steam account details and hijacks sessions, the Lumma and Vidar infostealers and the RenEngine loader. In one test, a wallpaper launched a real game while malware ran in the background. Many wallpapers had thousands of downloads and some had tens of thousands. Kaspersky believes several independent groups were involved, mainly targeting Steam users in China and Russia, with victims also found in other countries. BleepingComputer reported that Steam removed all the wallpapers Kaspersky identified. This is not a software flaw, so there is no patch. Researchers expect new malicious uploads, and no change to Valve's rules was reported. Dates for when the campaign began vary between reports.
- What
- Poisoned software
- Affects
- Wallpaper Engine application wallpapers on Steam Workshop (Windows)
- Affected
- Wallpaper Engine application-type wallpapers downloaded from Steam Workshop on Windows
- Fixed in
- Nothing to patch
- Since
- 16 June 2026
- Closed
- 16 June 2026
Timeline
- UpdateNothing to patch
BleepingComputer reported that Steam had removed all the malicious wallpapers Kaspersky identified, and that researchers expect attackers to keep uploading new ones. No new Valve policy or restriction on application wallpapers was reported.
- Made publicNothing to patch
Kaspersky published research on dozens of malicious 'application' wallpapers on Steam Workshop for Wallpaper Engine, many downloaded thousands or tens of thousands of times, carrying account-stealing and infostealer malware. One sample dates from December 2025.
Sources
- Kaspersky discovered a malware campaign targeting Steam users through infected wallpaperKaspersky · 16 June 2026
- Steam Workshop abused to spread malware via Wallpaper Engine appBleepingComputer · 16 June 2026
- Gamers beware — experts flag Steam Workshop is being abused to spread malware via Wallpaper Engine appTechRadar · 16 June 2026