Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk

Since late 2025, multiple threat actors have been embedding malware into Wallpaper Engine "application wallpapers" on the Steam Workshop; infected wallpapers execute code that drops backdoors (e.g., DarkKomet), infostealers (Vidar, Lumma), crypto miners and ransomware, hijacks live Steam sessions to steal accounts and propagate more malicious content, and has been downloaded thousands to tens of thousands of times—primarily targeting gamers in China—while Steam has removed identified items but new malicious wallpapers continue to appear.