Your PC's animated wallpaper could be a virus, but you don't know it yet: Wallpaper Engine alarm

The Steam Workshop platform has come under the radar of cybercriminals, who have exploited the community-created content distribution system to spread various malware through some wallpapers intended for Wallpaper Engine. According to research analysis from Kaspersky, the malicious files reached thousands, and in some cases tens of thousands, of downloads before their removal.

Steam Workshop represents the integrated hub of Steam for sharing user-generated content. In addition to mods, maps, skins, and tools, the platform also allows for the distribution of wallpapers for Wallpaper Engine, a popular desktop customization application that has garnered nearly a million reviews on Steam.

The software supports four types of wallpapers: videos, interactive scenes, web pages capable of playing multimedia content, and executable Windows applications.

It is this last category that has paved the way for attacks. Wallpapers can indeed include complete programs, such as games, desktop widgets, and system monitoring tools.

Researchers found that malicious actors have been exploiting this feature at least since the end of 2025. Infected files were uploaded to Steam Workshop and presented as regular wallpapers to induce users to install them.

Technical analysis revealed that the malicious code was found either directly inside the wallpaper package or in password-protected archives that victims were urged to open. In both cases, the payload would execute automatically upon the wallpaper's installation.

The identified threats are particularly heterogeneous. Kaspersky pinpointed the presence of the infostealers Lumma and Vidar, malware designed for stealing data and credentials, along with software for cryptomining, loaders for botnets, the malware RanEngine, and even some variants of ransomware.

The consequences can be very serious. The malware distributed through the compromised wallpapers can steal Steam accounts, install backdoors on the system, and compromise the PC with further malicious components.

Valve has already identified and removed all malicious applications reported by researchers. However, experts warn that new attempts at upload could occur in the future. To reduce risks, the recommendation is to download content only from reliable sources and to scan every file obtained from Steam Workshop with an updated antivirus software.