Kaspersky researchers uncovered an ongoing malware campaign abusing Steam Workshop and Wallpaper Engine to distribute malicious software disguised as animated wallpapers. The campaign primarily targeted users in China and Russia, with additional victims in Singapore, Germany, Vietnam, India, and Canada. Attackers exploited Wallpaper Engine’s ability to run executable programs on Windows devices, embedding malware directly in wallpaper files or hiding it in password-protected archives. Once installed, these malicious wallpapers automatically executed harmful payloads. One sample appeared as a harmless desktop game but secretly deployed the DarkKomet backdoor to steal Steam account data and hijack active sessions. Kaspersky found multiple malware families involved, including Lumma, Vidar, and RenEngine, indicating activity by multiple threat actors, a press release said.

“Trusted platforms can be abused to distribute malware: the attacks rely on users trusting content hosted within legitimate ecosystems. While many of the malware families involved are well-known, the delivery mechanism enables attackers to reach large numbers of potential victims through seemingly harmless content,” commented Maxim Starodubov, a cybersecurity expert at Kaspersky. 

Detailed information is available in a report on Securelist.

Kaspersky recommends users exercise caution when downloading applications, even from trusted sources, verify content creators’ legitimacy before installing user-generated content, and rely on proven cybersecurity solutions to detect threats.