Steam Workshop Malware Campaign Uses Wallpaper Engine to Steal Accounts and Infect Gamers

A sophisticated malware campaign has been abusing Steam Workshop’s sharing model to distribute backdoors, infostealers and crypto miners hidden inside Wallpaper Engine packages, primarily targeting gamers in China and Russia.

The campaign exploits Wallpaper Engine’s “application” wallpaper type essentially standalone executables that run as animated desktop backgrounds to execute arbitrary code the moment a user applies a compromised wallpaper.

With Wallpaper Engine’s large user base and deep integration with Steam Workshop, attackers have found an efficient, high-trust delivery channel for widespread infections and account takeover.

Wallpaper Engine is a widely used live wallpaper app on Steam that supports video, scene, web and application wallpapers.

Application wallpapers are the riskiest because they permit full Windows executables to run as the user’s desktop background, enabling interactive mini‑apps, widgets and tools.

Threat actors package trojanized application wallpapers and publish them to Workshop where enthusiastic community members discover and install them.

In many observed cases the malicious payloads were bundled as part of the wallpaper archive or hidden inside password‑protected archives with the key embedded in filenames or configuration JSONs so the installer script could extract them without user suspicion.

Kaspersky said in a report shared with GBhackers, Wallpaper Engine is an app that allows you to put animated wallpapers on your desktop. It’s available for both Windows and Android.

Once executed, these wallpapers behave normally on the surface the animated background or game-like UI works as expected while stealthy code performs malicious actions in the background.

Steam Workshop Malware Campaign

Analysis of multiple samples uncovered a consistent multi-stage pattern. An executable wallpaper drops a backdoor binary (for example, Synaptics.exe linked to the DarkKomet family) and launches a secondary module such as ._cache_GAME1.exe which in turn installs a tampered system library (AggregatorHost.dll) containing the credential-harvesting payload.

That modified library searches for live Steam sessions and hijacks them, harvesting authentication data and session tokens.

Stolen session information is exfiltrated to attacker-controlled infrastructure one command-and-control endpoint documented in the investigation was hxxp://120.48.156[.]17/ey.php enabling the adversary to take over accounts and push additional malicious content into Steam Workshop using legitimate, compromised profiles.

Victim telemetry indicates this is not a narrowly targeted, single‑actor operation. The campaign distributes a broad toolbox: infostealers and password stealers such as Vidar and Lumma, backdoors like DarkKomet, droppers and Python‑based trojans, crypto miners that sap system resources, and even ransomware variants.

Geographic distribution shows a heavy concentration in China nearly 89% of malicious download attempts observed followed by Russia at 5.5%, with smaller percentages in Singapore, Hong Kong, Germany, Vietnam, India and Canada.

The localized artwork and titles tailored for Chinese users suggest deliberate targeting, though the infrastructure and techniques could be reused globally with minimal adaptation.

Steam responded by removing identified malicious Workshop items, but the campaign demonstrates the limitations of platform moderation against persistent, creative abuse.

Defenders should treat user‑shared content that runs executable code with elevated suspicion. Practical mitigations include disabling application‑type wallpapers, restricting Wallpaper Engine’s permissions, vetting Workshop content before installation, and scanning downloaded wallpaper packages with up‑to‑date endpoint protection.

Security vendors flagged the discovered samples with heuristics and verdicts such as HEUR:Trojan-PSW.Win32.gen, HEUR:Backdoor.Win32.DarkKomet, Trojan-Dropper.Python.Agent and HEUR:Trojan-Ransom.Win32.Gen.gen, indicating detection is possible when proactive layers are in place.

Gamers and platform operators must assume shared content can be hostile and incorporate application‑level controls, strict review processes and threat detection to prevent future abuse.

This incident underscores a larger trend: attackers increasingly weaponize legitimate, community-driven platforms and creative features to bypass traditional defenses.

Indicators of compromise

MD5	C2 servers
95856f2ce428c728d9781d3296558068	http://202.144.192[.]29
af080780cca2acd1d082ce01e7cc346a	http://202.144.192[.]29/audit.php
c133c3dd9f7d6934598025047df41abf	http://202.144.192[.]29/download2/Themes2.zip
d1693bbff456ae8fa3360446706df6da	http://120.48.156[.]17
8c2cc585ad8a13a72a704c0fda0c9854	http://120.48.156[.]17/ey.php?ka=user1&id
b9fa763a53da3eea742d0f3c845a8c09	http://brightly[.]to
ded08ae5df7f1b12e5fdb767dbbed0b1	http://brightly[.]to/download2/Themes2.zip
20965254e29104986e11939decd39549	https://www.dropbox[.]com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
18dedc0009f0927cba6425c84cce9883	https://docs.google[.]com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
0f4f01c6d495abb37403072dd017ce8d	(no specific C2 URL listed)
5620f01284329f561b1839a36be55355	(no specific C2 URL listed)
fe1f6485013cd5e6d5cf718049b0b8d6	(no specific C2 URL listed)
74414ed4b63aadec039b603c32762b80	(no specific C2 URL listed)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.