Attackers have started hiding programs for stealing Steam accounts in animated wallpapers for Wallpaper Engine. Dangerous sets are distributed through Steam Workshop — a service where users download mods, maps, and other content for games, reported Kaspersky Lab.
The campaign has been active since at least late 2025. Some infected wallpapers have already been downloaded tens of thousands of times. The attacks are primarily aimed at players from Russia and China, but infection attempts have also been recorded in Germany, Vietnam, India, Canada, Singapore, and Hong Kong.
The problem is that Wallpaper Engine can run wallpapers based on applications. Along with a beautiful screensaver, an executable file can get onto the computer, which runs in the background and, without visible signs of hacking, steals account data, intercepts an active Steam session, or opens remote access to the PC for attackers.
Kaspersky Lab advises checking the reputation of content authors even on well-known platforms and not running files from suspicious sets. The company's security solutions already detect and block threats associated with this campaign.
Read more on the topic:
- RTX 5090 cracked most popular passwords in less than an hour - Kaspersky Lab
- Service frozen, players worried: Roskomnadzor denies blocking Steam
- Smartphone turned into a "zombie": Russian Ministry of Internal Affairs reported a new virus for Android