In June 2026, Kaspersky published research showing malware hidden inside Steam Workshop wallpapers that steal your Steam account and install backdoors on your PC.
Wallpaper Engine is a $4.99 Steam utility, not a game. You use it to put animated, interactive, or video wallpapers on your Windows desktop. Over two million community-made wallpapers live in its Steam Workshop, making it one of the biggest Workshop libraries on Steam. There is also an Android companion app that lets you use those same wallpapers on your phone. The app itself is clean. The problem came from a specific corner of Workshop content that most users never touch.
Here is what actually matters for your safety. Wallpaper Engine supports multiple wallpaper types, and only one is dangerous: "application wallpapers," which are executable programs dressed up as wallpapers. Most of the Workshop's two million items are scene, video, or web wallpapers. Those are safe. Application wallpapers are hidden from default Workshop browsing, and the app warns you explicitly before running one. The Steam community's own response made this clear fast: posts on the Wallpaper Engine forums pointed out that 90 percent of users are not affected because they never installed an application-type wallpaper to begin with.
The Kaspersky researchers found dozens of malicious application wallpapers, each downloaded thousands to tens of thousands of times. The attackers targeted users in China mainly, with Russia a distant second. The payload is serious: infostealer malware that grabs your Steam credentials and session tokens, plus backdoor software and crypto miners in some packages. The campaign had been running since at least late 2025.
If you want to check your exposure: open Wallpaper Engine, go to your subscribed items, and filter by type. If you have no application-type wallpapers subscribed, you were not a target of this campaign.
Why it's blowing up right now
The search spike is pure alarm. An app with close to a million Steam reviews gets tied to account theft, and the headline writes itself. The story broke on Securelist on June 15 and was picked up by BleepingComputer, Tom's Hardware, PCGamesN, and TechRadar within days, each adding a fresh wave of searches. Steam and Valve have been silent on a public fix or Workshop policy change as of this writing. Watch for an official statement from Valve or the Wallpaper Engine team, since that is the moment the story either escalates into a bigger platform security debate or quietly closes.