A seemingly innocuous animated wallpaper in Steam Workshop can quietly run a backdoor while cherry blossoms drift across your desktop. Kaspersky researchers have confirmed an active campaign using Wallpaper Engine’s Open Workshop ecosystem to distribute malware disguised as an animated desktop background. A number of brutal wallpaper packages – many featuring anime-style art – have been collected thousands to tens of thousands of each download before it is deducted. The campaign has been running ever since by the end of 2025and new infected uploads continue to appear after Valve removes the old ones. The Wallpaper Engine itself is indestructible. The open Workshop ecosystem is an attacking environment.
Why Wallpaper can steal your Steam account
Wallpaper Engine’s “app wallpaper” feature allows Workshop objects to function as full Windows exploits – and attackers beware.
That feature means that wallpaper packages can contain .exe, .dll and text files that run when you use them. One sample from December 2025 presented what looks like an innocent little desktop game. After the pixels, it released the DarkKomet background and harvest Steam session data. Other packages brought the Lumma and Vidar infostealers, the RenEngine loader, crypto-miners, and ransomware.
Kaspersky notes that “the application-based background feature allows executable programs to run directly on a user’s Windows computer, allowing attackers to distribute malicious software under the guise of legitimate content.” Attackers use two main tactics: bundling exploits hidden inside a wallpaper package, or secretly sending trailing users password-protected archives where the password resides once in the file name – like leaving a house key under a doormat, unless the doormat says “KEY HERE.”
This is not one unified group. Kaspersky verifies multiple independent threat actors using the same vector. About 89% of malicious downloads targeting users in China, and Russia approx 5.5%and victims across Singapore, Germany, Vietnam, and Canada.
What You Should Really Do About It
You can keep your own animated wallpapers – just stop treating Workshop downloads as the preferred app store.
- Skip any Workshop object that includes .exe, .dll, or text files above the background image itself
- Treat password-protected wallpaper archives as an immediate red flag
- Stick to established creators with a long track record and proven community feedback
- Run a reputable security suite – Microsoft Defender intercepts known malicious packages (note: Kaspersky detected these threats, although other Western regulators have expressed different concerns about the vendor)
- Enable Steam Guard, use a unique password, and if there’s anything portable, log out and fully scan the clean device.
The old “anime girl got a virus” joke is no longer a joke. Valve has removed the identified objects, but Kaspersky warns that new ones may continue to appear – the same concept that applies here extends to Discord bots, game mods, and browser extensions where any user-generated content can use the code. “App wallpaper” is a useful option with a beautiful face. Treat it as one thing.