The cybersecurity company Kaspersky has issued a warning about malware being spread through Steam Workshop files for Wallpaper Engine. Malware, hidden through user uploaded wallpaper packages, can lead to issues such as hijacked Steam accounts, the installation of backdoors to a user's PC, or even hidden crypto mining processes.
Wallpaper Engine includes support for various wallpaper formats: Static images, video, interactive scenes, web pages, and even applications. It's that last one, applications, that is acting as the main method of attack in the Steam Workshop content. Kaspersky has found "dozens of infected wallpaper packages available through Steam Workshop."
The more concerning part is the fact that many of these malware filled packages "had thousands or even tens of thousands of downloads."
There were two primary delivery methods that attackers used. In some cases, malicious executable files, DLLs, and scripts were bundled directly with the wallpaper package. In others, attackers hid malware inside password-protected archives, with passwords embedded in archive names or configuration files. Once the wallpaper was installed, malicious payloads executed automatically.
Kaspersky says that the attacks likely came from "multiple independent threat actors rather than a single group." There were wallpapers that delivered malware such as the "Lumma and Vidar infostealers and the RenEngine loader."
A detailed report from Kaspersky was shared on Securelist. Kaspersky found that the infected Wallpaper Engine wallpapers were related to anime in some way, and almost all of them labeled as "Mature." You are free to draw your own conclusions about the relationship between busty anime ladies, the anime fans that enjoy that content, and the ease in which malware can spread.
