What the Wallpaper Engine Malware Campaign Is and Why It Matters
The Wallpaper Engine malware campaign is a long-running attack where cybercriminals hide malicious executable files inside animated Steam wallpapers, using Steam Workshop downloads to silently steal gaming accounts and install backdoors on Windows PCs. Researchers found that attackers have been abusing Wallpaper Engine’s Steam Workshop content since late 2025, turning harmless-looking anime and animated wallpapers into malware in wallpapers that can hijack Steam sessions and compromise systems. This is a Steam security threat based on trust, not a bug in Steam or Wallpaper Engine itself. According to Kaspersky, dozens of malicious wallpapers were downloaded tens of thousands of times before removal, and the campaign has continued as new uploads appear to replace those taken down. Because Wallpaper Engine has more than 20 million downloads, the scale of potential Steam account theft is significant for anyone who uses user-generated wallpapers.
How the Attack Works: From Anime Wallpaper to Stolen Steam Account
Wallpaper Engine includes an Application Wallpaper feature that lets wallpapers run as full Windows programs, which attackers use to execute hidden .exe, .dll, and script files the moment a wallpaper is applied. Some malicious packages bundle the visual wallpaper alongside extra executables in archives, often password-protected, that unpack and run automatically. Others mimic mini-games or widgets that work as advertised while quietly deploying loaders and backdoors like DarkKomet in the background. Once active, these payloads can steal Steam credentials, hijack live sessions, and send the data to attacker-controlled servers. In some cases, the same wallpaper package can install infostealers, crypto-miners, or even ransomware. This abuse of the Application Wallpaper feature turns a cosmetic download into a direct path for Steam account theft and wider system compromise without raising obvious suspicion.
How to Avoid Wallpaper Engine Malware Before You Get Infected
You do not need to uninstall Wallpaper Engine, but you should treat Workshop items as untrusted software. Start by checking the creator’s profile: look for a history of legitimate uploads, a filled-out profile, and activity that predates the wallpaper you are interested in. Examine comments for reports of crashes, antivirus alerts, or suspicious behavior. Avoid wallpapers that request or link to external downloads, password-protected archives, or executable installers outside Steam. Inside Wallpaper Engine’s item details, be wary of wallpapers listed as "application" types that include multiple .exe or .dll files, especially with odd names. Keep your antivirus enabled and up to date so it can scan Workshop downloads in real time. Most importantly, do not assume that content is safe because it is on Steam—treat any downloadable executable in wallpapers as a potential Steam security threat until you have checked it carefully.
How to Check for and Remove a Suspicious Wallpaper
If you suspect Wallpaper Engine malware, stop using the wallpaper immediately and switch to a default static background. In Steam, unsubscribe from any recently added wallpapers, then close Wallpaper Engine and Steam. Run a full system scan with your antivirus to detect known backdoors, loaders, and infostealers that may have arrived through malware in wallpapers. Open the Wallpaper Engine installation and Workshop content folders and look for unexpected .exe, .dll, or script files with random or system-like names; do not run them, and let security software handle quarantine or deletion. Check Task Manager and your startup list for unfamiliar processes added around the time you installed the suspicious wallpaper. If your antivirus finds a threat, follow its cleanup instructions, reboot, and run a second scan to confirm removal before using Wallpaper Engine again.
Securing a Possibly Compromised Steam Account
If you used potentially infected wallpapers, treat your Steam account as exposed. Change your Steam password from a clean device you have scanned, and avoid reusing passwords from other services. Enable Steam Guard two-factor authentication to make it harder for attackers to reuse stolen credentials or live sessions. Review your recent account activity, looking for unknown devices, unusual logins, or trades and purchases you did not make. Check your authorized devices and revoke any you do not recognize. Inspect your Steam inventory and market history for unexpected transfers or listings. If you see signs of Steam account theft, use Steam’s account recovery tools to regain control and report the incident. Finally, consider resetting passwords for other services where you reused the same or similar login details, since infostealers often target multiple accounts at once.
