How Malware Sneaks into Wallpaper Apps on Steam and Chrome
Malware in wallpaper apps refers to malicious code hidden inside desktop wallpapers or browser new-tab themes that can steal accounts, install backdoors, or hijack your browser while appearing to be harmless visual customizations. On Steam, attackers abuse trust in Wallpaper Engine’s Steam Workshop, uploading anime-style “application wallpapers” that execute Windows files as soon as you apply them. These packages can contain .exe, .dll, and scripts that quietly steal Steam session data or install malware like backdoors, information stealers, crypto-miners, or ransomware. According to Kaspersky, cybercriminals have run an active wallpaper-based campaign since late 2025, repeatedly re-uploading new infected wallpapers after old ones are removed. In Chrome, seemingly cute anime wallpapers and football new-tab extensions have been used to collect user data and fake Google search traffic, despite Chrome Web Store listings claiming they collect no data at all.
Steam Wallpaper Malware: Anime Art, Hidden Backdoors
Wallpaper Engine’s popularity and its “Application Wallpaper” feature make it a prime target. This feature lets wallpapers run as standalone Windows programs, which is useful for mini-games, system monitors, or planners—but it also lets unverified code run on your PC. Attackers bundle their malicious payloads inside Workshop wallpapers, often as archives that include compromised executables, DLLs, or password-protected files. Once you apply the wallpaper, the executable runs, steals your Steam credentials or live session tokens, and sends them to a remote server. One test wallpaper packaged a game called NTRaholic that worked as advertised while silently dropping a DarkKomet-family backdoor named Synaptics.exe and a malicious AggregatorHost.dll. Kaspersky reports that dozens of these malicious wallpapers reached thousands to tens of thousands of downloads each, meaning tens of thousands of Steam users have been exposed in the past year.
Chrome Wallpaper Extensions: Data Theft and Fake Traffic
On the browser side, malware in wallpaper apps has appeared as Chrome new-tab themes and background extensions. Socket’s Threat Research Team found 152 extensions across 38 publisher accounts running a coordinated adware and traffic-fraud operation, installed by about a hundred and five thousand Chrome users. Every Chrome Web Store listing claimed zero data collection, yet their own linked privacy policies admitted to harvesting user information. The extensions opened hidden tabs and routed your browser through URLs packed with Google ved and usg tokens, making fake ad clicks look like real search traffic so advertisers and affiliate programs would pay premium rates. Alongside this traffic fraud, privacy policies described collection of network and device data. This behavior shows why Chrome extension security matters: even wallpaper or new-tab add-ons can spy on browsing and abuse your connection, all while pretending to be cosmetic.
How to Spot and Remove Infected Steam Wallpapers
To protect yourself from Steam wallpaper malware, treat every Workshop download as untrusted until you check it. Start with the creator’s profile: look for a history of genuine uploads, clear descriptions, and real comments. Be wary of brand-new accounts, vague descriptions, or comments warning of suspicious behavior. Avoid wallpapers that require you to download extra files from outside Steam or enter passwords for archives. If you suspect an infected wallpaper, unsubscribe from it in Wallpaper Engine, then delete its local files via Steam’s Workshop content folder. Run a full system scan with a reputable antivirus and remove any detected threats. Change your Steam password, enable Steam Guard, and sign out of all other sessions to shut out hijackers. Finally, limit yourself to wallpapers with many long-standing positive ratings and avoid applying “application wallpapers” from unknown or low-effort publishers.
Secure Your Browser: Audit and Remove Infected Extensions
Improving Chrome extension security starts with an audit of what is already installed. Open your browser’s extensions page and remove anything you do not remember installing, no longer need, or that comes from a publisher name you do not recognize. Pay attention to permissions: a simple wallpaper or new-tab extension should not need broad rights like reading all data on every site or changing your search settings. Click through to the extension’s privacy policy; if it conflicts with the Chrome Web Store listing or admits extensive data collection, uninstall the extension immediately. After you remove infected wallpapers or extensions, clear your browser cache, reset your default search engine and new-tab page, and change passwords for your main accounts, especially if you reused them. Going forward, install only highly rated extensions from well-known developers and review permissions before you click Add to Chrome.
