Hackers are using Steam Workshop and Wallpaper Engine to spread malware and steal accounts

Live updates

1. 1h ago

   Kaspersky Detects Malware and Crypto Miners in Steam Workshop Wallpapers

   Cybersecurity firm Kaspersky found malicious code hidden in community-made desktop themes for Wallpaper Engine. The malware targets gaming PCs to steal accounts and install backdoors. Some infected packages also deploy cryptocurrency miners.

   What's confirmed:

   • Kaspersky identified malware hidden in Steam Workshop packages for Wallpaper Engine.
   • The malicious code is embedded in user-submitted desktop themes.
   • The attacks aim to steal user accounts and install backdoors on gaming PCs.
   • Infected systems are being used to run cryptocurrency miners.

   Still unconfirmed:

   • Dozens of infected Steam Workshop packages are deploying ransomware.
   confidence 90%
2. 3d ago

   Malware Spreading Through Steam Workshop Wallpaper Engine Packages

   Threat actors are embedding malware in Wallpaper Engine packages on the Steam Workshop to steal login credentials and hijack active sessions. The campaign primarily targets gamers in China and Russia. Affected users may also have their Windows PCs infected.

   What's confirmed:

   • Hackers are using the Steam Workshop to distribute malware via Wallpaper Engine packages.
   • The attacks target users in Russia and China.
   • The malware is designed to steal user login credentials and session data.

   Still unconfirmed:

   • The FBI is investigating the attacks.
   • A single group is responsible for the coordinated campaign.
   • The campaign began in late 2025 according to a Kaspersky Securelist report.
   • Attackers are specifically using waifu imagery to lure victims.
   • Valve removed physical Steam gift cards from stores to fight fraud.
   confidence 80%
3. 3d ago

   Malware Campaign Targets Steam Users via Wallpaper Engine

   Hackers are distributing malware through the Steam Workshop by embedding malicious code in Wallpaper Engine packages. These downloads can hijack active Steam sessions and steal login credentials, crypto wallets, and session data. Some malicious packages were downloaded tens of thousands of times before removal.

   What's confirmed:

   • Cybersecurity firm Kaspersky discovered malware hidden in Wallpaper Engine packages on the Steam Workshop.
   • Malicious wallpapers are designed to steal Steam accounts and hijack active sessions.
   • Dozens of malicious packages were downloaded tens of thousands of times.
   • The campaign has been active since late 2025.
   • The malware can steal crypto wallet data, credentials, and session data.

   Still unconfirmed:

   • Anime wallpapers are being used to spread the malware.
   • The campaign includes the distribution of backdoors and crypto miners.
   confidence 95%