The Wallpaper Engine Feature Behind the Steam Malware Attacks
Wallpaper Engine’s Most Useful Feature Is Also a Built-In Way to Run Programs on Your PC — Here’s Why That Matters Right Now
Kaspersky just found dozens of malware-laced wallpapers on Steam Workshop, downloaded tens of thousands of times. Every headline tells you to scan before you apply. Almost none explain the actual design choice that made this possible in the first place — a wallpaper type that isn’t an image or video at all, but a real, running Windows program.
If you use Wallpaper Engine on Steam, you’ve probably seen the warnings circulating this week. Kaspersky’s security research team found dozens of malicious wallpapers hidden in Steam Workshop, and outlets from Tom’s Guide to BleepingComputer to TechRadar have all run some version of the same story: malware was hidden in wallpapers, scan before you apply, here’s how to stay safe. That advice is correct, but it skips the more interesting question — why is this even possible for a desktop wallpaper app in the first place?
Watch — How Wallpaper Engine Actually Works
A general walkthrough of Wallpaper Engine’s features, useful context before the security explanation below. All rights respective owner. Source: YouTube.
The answer lies in a specific feature most users have never thought twice about: “application wallpapers.” This article explains exactly what that feature is, why it’s the actual mechanism behind this entire malware campaign, and gives you the concrete, sourced steps to protect yourself — regardless of whether you’ve ever heard the term before today.
The Feature at the Center of This: “Application Wallpapers”
Wallpaper Engine supports four distinct types of wallpaper, according to Kaspersky’s own technical breakdown of the app. Three of them are what you’d expect: videos in common formats like MP4 or WebM, interactive “scenes” built inside the app’s own editor, and web pages — HTML content powered by JavaScript and CSS, which can include audio and video.
The fourth type is fundamentally different. Application wallpapers are described by Kaspersky as “active windows from third-party Windows-compatible software that Wallpaper Engine sets as the user’s desktop background.” In other words: not an image, not a video, not content rendered inside Wallpaper Engine’s own sandboxed editor — but an entirely separate, independently-running Windows program, with its window pinned behind your desktop icons so it looks like part of your wallpaper.
This isn’t a niche or accidental feature — application wallpapers genuinely serve real purposes. Kaspersky’s own report lists the legitimate use cases: “mini-games you play right on your desktop, to planners, calendars, system monitors, or widgets tracking your CPU or GPU usage.” A live CPU temperature gauge sitting on your desktop, or a small idle game you can click into between tasks — these are the reason the feature exists, and for most of Wallpaper Engine’s history, that’s exactly what it’s been used for.
But Kaspersky’s own framing of the risk is direct and worth quoting exactly: “The whole concept of ‘application wallpapers’ essentially allows foreign code to be run directly on your computer.” Because Wallpaper Engine sources this content from Steam Workshop — a free, open, community-upload platform — anyone can package literally any Windows executable as an “application wallpaper” and publish it for the entire user base to find and install.
Putting all four wallpaper types side by side makes the actual risk gradient clearer than treating “Wallpaper Engine” as a single category of varying danger:
| Wallpaper Type | What It Actually Is | Can It Run Code on Your PC? |
|---|---|---|
| Video | A standard video file (MP4, WebM) played on loop | No — rendered by Wallpaper Engine’s own player |
| Scene | Interactive content built inside Wallpaper Engine’s sandboxed editor | No — confined to the editor’s own engine |
| Web page | HTML/JS/CSS rendered in an embedded browser view | Limited — browser-sandboxed, but can include audio/video and scripted behaviour |
| Application | A separate, independent Windows executable (.exe) | Yes — full, unrestricted code execution, identical to installing any other program |
Three of the four categories are constrained to some degree by Wallpaper Engine’s own playback engine or browser sandbox. The fourth has no such constraint by design — which is exactly why it’s the one category capable of producing the infection chain described below, and not a coincidence of which type attackers happened to pick.
What This Actually Looked Like in Practice
Kaspersky’s report walks through a specific sample they recovered from December 2025 to illustrate how convincing this can be. The malicious wallpaper was disguised as a working desktop game. In Kaspersky’s own words: “Once launched, there’s absolutely nothing to trigger your suspicion. The built-in game boots up flawlessly, runs smoothly, and the desktop controls work exactly as they should.”
Behind that fully-functional game, the wallpaper quietly performed a second job. According to Kaspersky’s technical analysis, the application dropped a backdoor file named Synaptics.exe — identified as part of the long-known DarkKomet malware family — directly onto the victim’s system. Simultaneously, a second component disguised as the game’s own launcher installed a modified version of a legitimate-sounding system library, AggregatorHost.dll, with one specific job: locate the Steam application on the infected PC and harvest the account credentials and active session token. The stolen session data was then sent to a hardcoded server controlled by the attackers, giving them the ability to hijack the victim’s Steam account — and, per Kaspersky, use that hijacked account to upload even more malicious wallpapers, helping the campaign spread further.
The reason this is more dangerous than a typical fake download is the framing. A user browsing Steam Workshop for wallpapers has already mentally categorized what they’re about to install as “just a wallpaper” — a passive visual, not executable software. Application wallpapers break that assumption silently. There’s no separate installer prompt, no Windows SmartScreen warning distinct from what you’d see launching any new app, and no visual difference from a legitimate game-style wallpaper — which is precisely why dozens of these went undetected long enough to rack up tens of thousands of downloads each.
Who’s Actually Affected — The Real Numbers
This wasn’t evenly distributed. Kaspersky’s telemetry shows the campaign was heavily targeted: 89% of detected malicious download attempts originated in China, with wallpaper art styles and naming specifically tailored to that audience. Russia accounted for 5.5% of downloads, followed by smaller shares in Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%).
Kaspersky’s own assessment is that this isn’t one coordinated operation — the diversity of malware families involved (DarkKomet, the Lumma and Vidar infostealers, the RenEngine loader, and several ransomware and cryptomining variants) points to “multiple scattered, independent hacking groups… all jumping on the same trend,” exploiting the same structural weakness rather than running a single shared campaign.
Kaspersky’s original report estimated the campaign had been active “since late 2025.” A June 17, 2026 update to the same report revised that significantly earlier: “We have since confirmed that the malicious wallpapers were present in the app as early as August 2025” — meaning the exposure window was several months longer than most of the initial news coverage reported.
The Practical Steps That Actually Protect You
Steam has already removed the specific malicious wallpapers Kaspersky identified, but Kaspersky is explicit that this shouldn’t be treated as a closed case: “given how frequently new infected wallpapers keep popping up on the Steam Workshop, you shouldn’t rely on Steam to catch everything.” Here’s what actually reduces your risk going forward, based directly on Kaspersky’s own findings.
Before subscribing, check the wallpaper’s listing on Steam Workshop for its type. Video and image wallpapers cannot run executable code — they’re fundamentally safer by design. If a wallpaper is listed as an “application,” “scene with embedded software,” or includes a downloadable game/widget component, apply extra scrutiny before installing it.
Kaspersky’s direct recommendation: “it’s highly recommended to run an antivirus scan on these types of wallpapers before you actually apply them.” Application wallpapers are downloaded to your Workshop content folder before being activated — scan that folder, don’t just trust the Workshop listing.
Kaspersky found attackers hiding payloads inside password-protected archives, with the password placed in the archive’s filename or in a JSON configuration file bundled alongside it. A wallpaper that requires you to manually enter a password to access its files is a significant red flag that has no legitimate reason to exist for a desktop background.
The malicious wallpapers Kaspersky found had already accumulated thousands to tens of thousands of downloads before detection — popularity alone isn’t proof of safety. Look instead at how long a Workshop item has existed, whether the creator has other established uploads, and whether comments mention any unusual behavior.
Review your Steam account’s active sessions and recent login history (Steam Settings > Account Details > Manage Steam Guard or the security/sessions section) for any device or location you don’t recognize, and change your password if anything looks unfamiliar.
Who Actually Found This
The findings throughout this article trace to a specific Securelist report authored by Kaspersky researchers Maxim Starodubov and Denis Brylev, published June 16, 2026. In a separate Kaspersky press statement on the same research, the company framed the broader lesson plainly: “Trusted platforms can be abused to distribute malware: the attacks rely on users trusting content hosted within legitimate ecosystems.” That’s a useful one-line summary of why this particular campaign worked as well as it did — Steam Workshop is, by reputation, a “safe” place to download things, which is precisely the assumption the application-wallpaper vector exploits.
It’s also worth knowing Wallpaper Engine’s actual scale while reading this: per concurrent Steam statistics cited alongside Kaspersky’s research, the app typically sees somewhere between 93,000 and 114,000 concurrent users at any given time, and costs $4.99 to purchase — making it one of the platform’s most-used non-game titles. That scale is part of why dozens of infected uploads could each reach tens of thousands of downloads before detection; the audience exploring Workshop content on any given day is genuinely large.
The structural lesson here — a platform that lets community content cross from “passive media” into “executable software” — isn’t unique to Wallpaper Engine. It’s the same underlying principle behind why we’ve covered tools like CrowdSec and reverse-proxy WAFs: any system that accepts user-supplied content needs a layer that doesn’t simply trust the platform’s own reputation. Steam Workshop’s removal-after-detection model is reactive by necessity — the same gap that motivates community-driven threat-sharing tools on the web server side.
My Take — Mr Wangdoo
What stands out to me about this story isn’t that malware got into a software marketplace — that happens regularly across every platform with user-generated content. What’s genuinely interesting is that the attack vector here isn’t a vulnerability in the traditional sense, like a bug that needed patching. It’s a deliberately-built feature operating exactly as designed, repurposed for harm. Application wallpapers aren’t broken; they’re doing precisely what they were built to do — running third-party Windows software as your background. The “vulnerability,” if you can call it that, is really a trust assumption: people don’t expect a wallpaper to behave like an installer.
That’s worth understanding beyond this specific campaign. Any platform that lets community content blur the line between “passive media” and “executable software” carries this same structural risk, regardless of brand or developer intent. If you use Wallpaper Engine, the simplest long-term safeguard isn’t a one-time scan — it’s treating application-type wallpapers with the same caution you’d apply to installing any unfamiliar piece of software, because that’s genuinely what they are.
Frequently Asked Questions
What are “application wallpapers” in Wallpaper Engine?
Application wallpapers are one of four wallpaper types supported by Wallpaper Engine. Unlike video, image, or “scene” wallpapers, they are active windows from separate, independently-running Windows programs that Wallpaper Engine displays as your desktop background. Legitimate examples include desktop mini-games, system monitors, and CPU/GPU usage widgets — but because they are real executable software, they can also be used to run malware disguised as a wallpaper.
Is Wallpaper Engine itself unsafe to use?
The app itself is not the issue — the risk is specific to the application wallpaper feature and Steam Workshop’s open, community-upload model, which allows anyone to publish content without prior vetting. Video, image, and “scene” wallpapers, which make up the large majority of Workshop content, cannot run executable code in the way application wallpapers can. Steam has removed the specific malicious wallpapers Kaspersky identified, but Kaspersky has stated similar uploads continue to appear.
How does this malware actually steal a Steam account?
In the sample Kaspersky analyzed, a malicious application wallpaper disguised as a working game silently dropped a backdoor (identified as part of the DarkKomet malware family) and a modified system library designed specifically to locate the Steam application, harvest account credentials, and hijack the active login session. The stolen session data was sent to an attacker-controlled server, which could then be used to access the victim’s account and, in some cases, upload further malicious wallpapers using that compromised account.
Which countries were most affected?
According to Kaspersky’s telemetry, 89% of detected malicious download attempts originated in China, with wallpaper content specifically tailored to that audience. Russia accounted for 5.5% of downloads, with smaller shares recorded in Singapore, Hong Kong, Germany, Vietnam, India, and Canada. Kaspersky notes there is nothing technically preventing the same campaign style from targeting other regions in the future.
How long has this campaign been active?
Kaspersky’s initial report estimated activity “since late 2025.” A subsequent update published June 17, 2026 revised this earlier, confirming malicious wallpapers had been present on the platform as early as August 2025.
What should I do if I think I downloaded a malicious wallpaper?
Run a full antivirus scan immediately. Check your Steam account’s active sessions and login history for unfamiliar devices or locations, and change your Steam password as a precaution. Kaspersky’s detection verdicts for this campaign include signatures such as HEUR:Backdoor.Win32.DarkKomet and HEUR:Trojan-PSW.Win32.gen — if your antivirus software supports custom signature lookups, these are worth checking against your scan results.
- Securelist by Kaspersky — Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk (June 16, 2026, updated June 17)
- SteamDB — Wallpaper Engine — daily active users and platform statistics
- BleepingComputer — Steam Workshop abused to spread malware via Wallpaper Engine app
- Kaspersky Press Release — Kaspersky discovered a malware campaign targeting Steam users through infected wallpaper
- Tom’s Hardware — Kaspersky finds malware hidden in Steam Wallpaper Engine \u2014 researcher attribution and usage statistics
