Valve Removes Dozens of Malicious Steam Wallpapers After 20M-50M-Install App Spread Malware
Updated
Updated · Tom's Guide · Jun 18
Valve Removes Dozens of Malicious Steam Wallpapers After 20M-50M-Install App Spread Malware
3 articles · Updated · Tom's Guide · Jun 18
Summary
Dozens of infected Wallpaper Engine assets were pulled from Steam Workshop after Kaspersky found they were being used to install backdoors, steal Steam credentials and, in some cases, deliver ransomware.
Wallpaper Engine’s “application wallpapers” can run as Windows executables, letting attackers hide malware in install packages or password-protected archives that users are tricked into opening.
Kaspersky said some malicious wallpapers had already logged thousands or tens of thousands of downloads; one posing as game-themed content installed DarkKomet and a tampered AggregatorHost.dll to harvest credentials.
The campaign also carried Lumma and Vidar infostealers, underscoring how Steam mods and wallpapers on trusted platforms can still be weaponized and why users should favor trusted creators and avoid unknown executables.