Malicious Steam Workshop Wallpapers Hijack Accounts via Wallpaper Engine

Malicious Steam Workshop Wallpapers Hijack Accounts via Wallpaper Engine, Distribute DarkKomet, Lumma, Vidar, and RenEngine

Published

Written by:

Lore Apostol
Cybersecurity Writer

Key Takeaways

Steam Workshop: Researchers found dozens of malicious wallpapers on Steam Workshop that exploit Wallpaper Engine.
Malware Mix: Payloads include DarkKomet, Lumma and Vidar infostealers, and RenEngine.
Top Targets: Gamers in China have accounted for most detections, with the campaign ongoing since at least August 2025.

How the Steam Workshop Attack Works

Cybercriminals embedded malware into these wallpapers and published them for free, Kaspersky researchers have uncovered. Each malicious wallpaper had already been downloaded thousands, or even tens of thousands, of times.

How the malware deploys | Source: Kaspersky

In one sample, launching the wallpaper drops a backdoor file called Synaptics.exe, part of the DarkKomet malware family. At the same time, an executable named ._cache_GAME1.exe boots the actual game, NTRaholic, while installing a modified system library, AggregatorHost.dll.

This library hunts for the Steam app, hijacks the user's live session, and sends collected data to an attacker-controlled server. With control of the session, attackers can upload more malicious wallpapers to Steam Workshop.

Malicious app wallpaper downloads by region | Source: Kaspersky

Kaspersky caught familiar threats, including the DarkKomet backdoor, the Lumma and Vidar infostealers, and the RenEngine loader.

Malware Victims

The diversity suggests multiple independent groups. Gamers in China made up 89% of malicious download attempts, with Russia second at 5.5%. By the time the report went live, Steam had removed the identified wallpapers and links.

A Hudson Rock report from early this year said that dozens of global companies were breached via infostealer credentials.

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.

Please enter a valid email address.

Welcome to TechNadu

This website uses cookies to ensure you get the best experience on our website.