Hackers are using Steam’s Workshop to spread malware in wallpaper content, according to reports.
As reported by BleepingComputer, hackers are uploading malware-laden wallpapers to the Steam Workshop’s Wallpaper Engine to hack gamers.
The malware varies and can lead to cryptomining of users’ devices, compromising their systems with remote access or access to their Steam accounts.
You’re out of free articles for this month
To continue reading the rest of this article, please log in.
Experts at Russian cyber security and antivirus provider Kaspersky said the impacted wallpapers had been downloaded by a high number of users.
“We discovered dozens of these malicious application wallpapers floating around Steam Workshop, and each one had already been downloaded thousands – or even tens of thousands – of times,” Kaspersky said.
Hackers chose wallpapers because they are executable applications that can be interactive, with widgets, games and system monitoring tools, making them an inbuilt security risk when combined with the community nature of the Steam Workshop.
Since late 2025, threat actors have been using the wallpapers to deploy malware, largely targeting users in China and Russia.
The Wallpaper Engine itself has nearly a million reviews, showing the potential damage that the malicious wallpapers can do.
Analysis of the wallpapers shows that malware is either bundled directly into the wallpaper package or behind password-protected archives that the user of the wallpaper is followed into opening. These payloads deploy as soon as the wallpaper is installed.
A test of one of the wallpapers, which posed as a game called NTRaholic, deployed DarkKomet malware upon execution, but also operated as a working wallpaper, reducing any chance of the target becoming suspicious.
The malware also installed a custom version of the “AggregatorHost.dll” system library, which searches for Steam accounts and exfiltrates credentials.
Other malware types include the Lumma and Vidar infostealers, botnet loaders, ransomware strains, RanEngine and cryptocurrency miners.
Steam has removed any wallpapers identified as malicious by Kaspersky, but the researchers warned that new malicious wallpapers are likely to show up. Users should scan any Steam Workshop products with an up-to-date antivirus.
Want to see more stories from trusted news sources?
Make Cyber Daily a preferred news source on Google.
Daniel Croft
Born in the heart of Western Sydney, Daniel Croft is a passionate journalist with an understanding for and experience writing in the technology space. Having studied at Macquarie University, he joined Momentum Media in 2022, writing across a number of publications including Australian Aviation, Cyber Security Connect and Defence Connect. Outside of writing, Daniel has a keen interest in music, and spends his time playing in bands around Sydney.