Malware distributed via Steam Workshop wallpapers

Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages, with further coverage provided by Bleeping Computer.

Kaspersky researchers have identified that malicious actors are exploiting the Steam Workshop platform, specifically through the Wallpaper Engine application, to distribute malware. These malicious wallpapers, disguised as legitimate user-generated content, can lead to Steam account hijacking, system compromise with backdoors, or cryptomining operations. Attackers have been uploading these malicious files, often bundled within password-protected archives, since at least late 2025. The payloads execute automatically upon installation, with examples including the DarkKomet backdoor, Steam credential stealers, Lumma and Vidar infostealers, cryptominers, and even ransomware.

While Valve has removed the identified malicious applications, the risk persists as threat actors are likely to submit new ones. Security experts recommend users scan all downloaded content from Steam Workshop with antivirus software.

Source: Bleeping Computer