Wallpaper Engine used to steal Steam accounts

Cybersecurity researchers have uncovered a malware campaign that has been exploiting a popular desktop customization application on Steam to infect thousands of computers and steal user accounts since late 2025. The campaign primarily targeted users in China and Russia but also affected individuals in several other countries.

The attack abuses Wallpaper Engine, a Steam application that allows users to set animated and interactive backgrounds. Researchers at Kaspersky found that threat actors uploaded dozens of malicious wallpaper packages to the Steam Workshop, Valve's platform for user-generated content. These packages were downloaded tens of thousands of times before being identified.

The security risk stems from Wallpaper Engine's support for "application" wallpapers, which are executable Windows programs that run code on a user's system. Attackers hid malware within these packages, either by bundling it directly with the wallpaper files or concealing it inside password-protected archives. The malicious payload executes automatically when a user installs and applies the wallpaper.

The malware's primary function is to steal Steam account credentials. In one analyzed example, a...