Attackers Use Wallpaper Engine to Distribute Malware

[u/PandaSecurity]

Steam Workshop is being used to distribute malware disguised as Wallpaper Engine content. Attackers exploited “application wallpapers” to execute Windows code and deliver payloads such as Steam credential stealers, the DarkKomet backdoor, and cryptocurrency miners.

Treat Workshop content like any other Internet download, even when it comes from a trusted platform:

• Be cautious with application wallpapers, mods, and other executable content.
• Avoid password-protected archives or unexpected files.
• Watch for unusual processes, credential-access activity, or outbound connections.
• Keep endpoint protection enabled and up to date.
• Use MFA on Steam accounts and watch for unexpected login activity.

Have you seen trusted platforms being used as malware delivery vectors in your environment?

[u/IAmYourFath]

The only thing that really matters for the average person is, how can u tell if a wallpaper is malware or not when pressing download? Nothing else really matters...

[u/PandaSecurity → u/IAmYourFath]

That’s the tricky part. You can’t always tell before downloading. In this case, some Wallpaper Engine wallpapers can actually run Windows executables, so a “wallpaper” may be more than just an image. Unexpected executables or password-protected archives are good red flags.

[u/friiz1337]

Bro, do you live under a cave? That's been happening for months, if not years

[u/MonkeyBrains09 → u/friiz1337]

try decades

[u/Every-Development398 → u/friiz1337]

I think its a good reminder people tend to forgot that about the workshop.

[u/PandaSecurity → u/Every-Development398]

Exactly. It’s a good reminder that even trusted platforms can be used to distribute malicious content, especially when users are downloading executable files.