Hackers are using Steam's Wallpaper Engine to distribute malware that can steal your logins

If you use Wallpaper Engine, now's a good time to pay attention. Kaspersky researchers have discovered that hackers are hiding malware inside wallpaper packages on the Steam Workshop, using them to steal Steam accounts and install additional malicious software on victims' PCs. The bad actors are exploiting the popularity of Steam's Wallpaper Engine to funnel users to the Workshop, from which they distribute malware.

Here's why this works so well: unlike a regular JPEG or PNG, Wallpaper Engine's "application wallpapers" are actual Windows executables that run on your system like any other program. That makes them a pretty convenient hiding spot for bad actors. The Wallpaper Engine also houses wallpapers in other formats, but it is these "application wallpapers' that are the primary source of the attack.

Once you launch one of these infected wallpapers, it drops a backdoor onto your system, part of the DarkKomet malware family, and quietly installs a modified system library designed to hunt down your Steam credentials and hijack your active session. After taking over your Steam account, the attackers use it to upload additional infected wallpapers, perpetuating the cycle by compromising more PCs.

4

Kaspersky also found other malware families in the mix, including Lumma and Vidar infostealers, crypto miners, botnet loaders, and ransomware strains. This suggests that multiple threat actors were abusing the same Wallpaper Engine vector. Kaspersky says the attacks were likely carried out by independent threat actors rather than a single group.

4

Dozens of compromised packages were found on Steam Workshop, some of which had already been downloaded tens of thousands of times. China and Russia were the primary targets, but victims were also identified in Germany, Singapore, Canada, Hong Kong, and India. Steam has since removed the malicious wallpapers Kaspersky flagged, but researchers warn that new ones are likely already on the way.

Therefore, you should treat this less like a closed incident and more like an ongoing threat. If you've downloaded interactive or application-type wallpapers from unknown creators recently, run a full malware scan and change your Steam password. Enabling Steam Guard if you haven't already is also a good move. And going forward, stick to wallpapers from creators with a decent track record and community reviews.