Kaspersky uncovers malicious Wallpaper Engine downloads on Steam Workshop targeting gamers and cryptocurrency holders with infostealers.
Cybersecurity researchers identified malware distributed as animated wallpapers on Steam Workshop, infecting thousands of users. The malicious downloads, often featuring anime-themed content, stole Steam credentials and deployed infostealers like Lumma and Vidar to target cryptocurrency wallets.
The infected wallpaper packages, some with tens of thousands of downloads, exploited Steam’s application-based wallpaper feature to execute malicious code. Kaspersky found dozens of such packages, primarily affecting users in China and Russia, with additional cases in Singapore, Germany, and Canada.
The malware campaign involved multiple threat actors and followed a series of similar Steam-related incidents. Infostealers like Lumma and Vidar are known for harvesting browser data, credentials, and cryptocurrency wallet information.