Experts at Russian cyber security and antivirus provider Kaspersky said the impacted wallpapers had been downloaded by a high number of users.

“We discovered dozens of these malicious application wallpapers floating around Steam Workshop, and each one had already been downloaded thousands – or even tens of thousands – of times,” Kaspersky said.

Hackers chose wallpapers because they are executable applications that can be interactive, with widgets, games and system monitoring tools, making them an inbuilt security risk when combined with the community nature of the Steam Workshop.

Since late 2025, threat actors have been using the wallpapers to deploy malware, largely targeting users in China and Russia.

The Wallpaper Engine itself has nearly a million reviews, showing the potential damage that the malicious wallpapers can do.

Analysis of the wallpapers shows that malware is either bundled directly into the wallpaper package or behind password-protected archives that the user of the wallpaper is followed into opening. These payloads deploy as soon as the wallpaper is installed.

A test of one of the wallpapers, which posed as a game called NTRaholic, deployed DarkKomet malware upon execution, but also operated as a working wallpaper, reducing any chance of the target becoming suspicious.

The malware also installed a custom version of the “AggregatorHost.dll” system library, which searches for Steam accounts and exfiltrates credentials.

Other malware types include the Lumma and Vidar infostealers, botnet loaders, ransomware strains, RanEngine and cryptocurrency miners.

Steam has removed any wallpapers identified as malicious by Kaspersky, but the researchers warned that new malicious wallpapers are likely to show up. Users should scan any Steam Workshop products with an up-to-date antivirus.