Story perspectives

Malicious Steam Wallpapers Infect Thousands in China, Russia

6/18/2026

Summary

Kaspersky Exposes Wallpaper Malware

Kaspersky reported that malicious Wallpaper Engine packages on Steam’s Workshop infected thousands of users in China and Russia.
A 2025 sample installed the DarkKomet backdoor Synaptics.exe and a DLL that stole Steam credentials.
Kaspersky found dozens of wallpapers that earned thousands to tens of thousands of downloads before Valve removed them.
The campaign uses malware families such as DarkKomet, Lumma Stealer, Vidar and RenEngine loader, with malicious uploads still appearing.

Summary

Authors Self-Infect

Legal filings show wallpaper malware authors accidentally infected their own computers, complicating attribution and liability.
U.S. prosecutors previously indicted a 16-person malware-as-a-service ring for $50 million crypto theft.
Valve quickly removed the malicious Steam Workshop content, which could prompt regulatory review of platform hosts’ content-safety duties.
Infections were reported in China, Russia, Singapore, Germany, India and Canada, highlighting gaps in global cyber-crime cooperation and the need for coordinated international legal frameworks.

Summary

Attackers Exploit Wallpaper

Attackers uploaded malicious wallpaper packages to Wallpaper Engine’s Steam Workshop, using it as a distribution channel.
Wallpaper Engine reports about 100,000 daily active users and close to one million Steam reviews.
The software runs on Windows and Android, though the investigation examined only the Windows version.
Its built-in editor allows creators to embed video, interactive scenes, and HTML/JavaScript, which can hide executable code in wallpapers.

Summary

Hackers Exploit Wallpaper

Researchers found that 89% of malicious Wallpaper Engine download attempts targeted gamers in China.
Analysts reported that attackers hide passwords in archive filenames or embedded JSON configuration files.
Password-protected archives force victims to enter passwords.
Multiple independent hacking groups exploit the wallpaper-distribution trend rather than a single mastermind.
China dominates the activity, with Russia at 5.5% and other regions showing measurable infection rates.

History

Historical Context

In June 2010 security researchers identified Stuxnet, the first worm to target SCADA systems, using four zero-day exploits to sabotage Siemens controllers at Iran’s Natanz enrichment facility. The incident sparked ongoing concerns about software platforms, leading regulators to pressure digital marketplaces such as Steam’s Workshop, where malicious “DarkKomet” backdoors have been reported.

1 of 5

Kaspersky Exposes Wallpaper Malware

Kaspersky reported that malicious Wallpaper Engine packages on Steam’s Workshop infected thousands of users in China and Russia.
A 2025 sample installed the DarkKomet backdoor Synaptics.exe and a DLL that stole Steam credentials.
Kaspersky found dozens of wallpapers that earned thousands to tens of thousands of downloads before Valve removed them.
The campaign uses malware families such as DarkKomet, Lumma Stealer, Vidar and RenEngine loader, with malicious uploads still appearing.

1 / 5