Verify any claim · lenz.io
Claim analyzed
Tech“Hackers have distributed malware through Steam Workshop items intended for the Wallpaper Engine app on Steam.”
Submitted by Noble Wolf 7f90
The conclusion
Open in workbench →The evidence shows that attackers did use Steam Workshop items for Wallpaper Engine to distribute malware. Security researchers documented malicious “application wallpapers” carrying credential-stealing and remote-access payloads, and Wallpaper Engine's developers later confirmed the abuse and tightened restrictions. The important caveat is that this was not every wallpaper type, but a specific executable-capable category.
Caveats
- The reported abuse was concentrated in Wallpaper Engine's "Application" wallpaper type, not ordinary static or video wallpapers.
- Most coverage traces back to Kaspersky's investigation, though later reporting and developer statements corroborate the event.
- The claim is historical: sources indicate the malicious items were identified, removed, and the feature was subsequently restricted.
Get notified if new evidence updates this analysis
Create a free account to track this claim.
Sources
Sources used in the analysis
Since late 2025, malware has been spreading rapidly through the Steam Workshop, exploiting Wallpaper Engine's "application wallpapers" feature to hide malicious code. This allows foreign code to run directly on users' computers, leading to stolen Steam accounts or systems infected with backdoors and crypto miners. Kaspersky's investigation found dozens of these malicious application wallpapers, downloaded thousands or tens of thousands of times, primarily targeting gamers in China and Russia.
Kaspersky researchers have uncovered an ongoing malware distribution campaign leveraging Steam Workshop and Wallpaper Engine, identifying multiple infected wallpaper packages with thousands of downloads. The attacks, likely conducted by multiple independent threat actors, were not limited to a single malware family, distributing DarkKomet backdoor, Lumma and Vidar infostealers, and the RenEngine loader. The main goal was stealing gaming accounts and deploying additional malware, with primary targets in China and Russia.
A sophisticated malware campaign has been abusing Steam Workshop's sharing model to distribute backdoors, infostealers, and crypto miners hidden inside Wallpaper Engine packages, primarily targeting gamers in China and Russia. The campaign exploits Wallpaper Engine's “application” wallpaper type, which are standalone executables, to run arbitrary code upon application, leading to account takeover and widespread infections. Payloads included infostealers like Vidar and Lumma, backdoors like DarkKomet, droppers, Python-based trojans, crypto miners, and ransomware variants.
Kaspersky researchers have identified that malicious actors are exploiting the Steam Workshop platform, specifically through the Wallpaper Engine application, to distribute malware since at least late 2025. These malicious wallpapers, disguised as legitimate user-generated content, can lead to Steam account hijacking, system compromise with backdoors, or cryptomining operations, with examples including the DarkKomet backdoor, Steam credential stealers, Lumma and Vidar infostealers, cryptominers, and even ransomware.
Hackers are exploiting Steam Workshop to hide malicious code inside community-made desktop themes for Wallpaper Engine, specifically leveraging its 'application wallpapers' which are full-on Windows executables. Kaspersky's researchers discovered dozens of these malicious wallpapers, many downloaded thousands of times, which bundle malware directly or hide it in password-protected archives, immediately infecting a PC upon installation.
Kaspersky researchers Maxim Starodubov and Denis Brylev reported that attackers have been smuggling malware into Steam through animated desktop wallpapers for several months, hijacking victim accounts to upload more infected files. Payloads included the DarkKomet backdoor, Lumma and Vidar infostealers, the RenEngine loader, miners, and ransomware, with 89% of malicious download attempts in China.
Threat actors are abusing Steam Workshop, Valve's community hub, to push various malware hidden in Wallpaper Engine packages, leading to Steam account hijacking, system compromise with backdoors, or cryptomining. Kaspersky tested one such wallpaper, which launched a game while installing a DarkKomet backdoor and a custom 'AggregatorHost.dll' to steal Steam credentials.
Kaspersky found that Steam Workshop wallpapers were weaponized to deliver malware via Wallpaper Engine, with dozens of malicious “application wallpapers” downloaded tens of thousands of times. These spread backdoors, infostealers (like Lumma and Vidar), miners, and ransomware. While Valve removed the infected uploads, users are warned that attackers could easily re-upload new ones.
Wallpaper Engine developers clarified that the issue was limited to a set of "Application" type wallpapers, mainly targeting Chinese users, and that these are turned off by default in search. They stated that security measures were tightened months ago, and the reported items from December were banned, with new measures in place to prevent large-scale abuse.
What do you think of the claim?
Your challenge will appear immediately.
Challenge submitted!
For developers
This same pipeline is available via API.
Verify your AI's output programmatically.
/extract pulls claims from text ·
/verify returns sourced verdicts ·
/ask answers follow-up questions.
Continue your research
Verify a related claim next.
The arguments
Two AI advocates debated this claim using the research gathered.
Argument for
Authoritative investigations by Kaspersky, as detailed in Source 1 (Securelist) and Source 2 (Kaspersky), conclusively prove that hackers have exploited Steam Workshop to distribute malware disguised as Wallpaper Engine items. Multiple independent security reports, including Source 5 (Tom's Guide) and Source 7 (BleepingComputer), confirm that threat actors specifically weaponized the app's "application wallpapers" feature to execute malicious payloads like the DarkKomet backdoor and Vidar infostealer directly on users' systems.
The Proponent's argument treats Kaspersky's write-up as “conclusive” while the rest of the cited coverage largely re-packages the same Kaspersky findings (Sources 1–2 echoed by Sources 5 and 7), so it fails to supply the independent corroboration from Valve/Steam or publicly reproducible evidence that would justify the motion's broad framing. Moreover, the Proponent omits the Wallpaper Engine developers' own scoping that the abuse was limited to a specific “Application” wallpaper type and was already mitigated via bans and tightened controls (Source 9, Steam Community), which undercuts the implied generality that Steam Workshop items for Wallpaper Engine are broadly being used to distribute malware.
Argument against
The motion overstates what's actually evidenced: even the Wallpaper Engine developers say the issue was limited to a specific “Application” wallpaper type, largely targeting Chinese users, with those items banned and tightened controls already in place, undermining the broad claim that hackers “have distributed malware through Steam Workshop items intended for Wallpaper Engine” as a general phenomenon (Source 9, Steam Community). Moreover, the reporting chain largely traces back to Kaspersky's own campaign write-up and derivatives (Sources 1–8), and without independent confirmation from Valve/Steam or reproducible public samples in the brief, the claim reads more like a narrowly scoped, mitigated incident being generalized into a sweeping assertion.
The Opponent's argument relies on a logical fallacy of moving the goalposts, as the atomic claim simply asserts that hackers "have distributed" malware through these items, not that it is an unmitigated or permanent general phenomenon. Furthermore, the Opponent's attempt to dismiss the extensive evidence as a single unconfirmed report is completely dismantled by Source 1, Source 2, and Source 7, which document that multiple independent threat actors successfully distributed diverse malware families to thousands of victims before the items were banned.
Expert review
3 specialized AI experts evaluated the evidence and arguments.
Expert 1 — The Logic Examiner
The logical chain from evidence to claim is direct and well-supported: multiple independent security sources (Securelist, Kaspersky, BleepingComputer, TechRadar, Tom's Hardware, GBHackers, SC Media, Tom's Guide) all confirm that threat actors distributed malware through Steam Workshop items specifically designed for the Wallpaper Engine app, with documented payloads including DarkKomet, Lumma, Vidar, and others downloaded thousands of times. The opponent's argument that the claim is 'too broad' commits a straw man fallacy — the atomic claim states only that hackers 'have distributed' malware through these items, which is a past-tense factual assertion fully supported by the evidence; the opponent conflates the claim's scope with a broader generalization that was never made. The Wallpaper Engine developers' own acknowledgment (Source 9) that the issue existed and was subsequently mitigated actually corroborates rather than refutes the claim, and the opponent's dismissal of multiple corroborating outlets as mere 'Kaspersky derivatives' is a genetic fallacy — the truth of the underlying events is not invalidated by the fact that reporting chains share a common investigative source.
Expert 2 — The Source Auditor
Highly authoritative cybersecurity sources, including Kaspersky (Source 2) and Securelist (Source 1), alongside reputable tech publications like BleepingComputer (Source 7), confirm that hackers successfully distributed malware via Wallpaper Engine's application wallpapers on Steam Workshop. This finding is further corroborated by the Wallpaper Engine developers themselves in Source 9, who acknowledged the abuse of this specific wallpaper type and implemented bans.
Expert 3 — The Precision Analyst
The claim is broadly phrased (“Hackers have distributed malware through Steam Workshop items intended for the Wallpaper Engine app”), and multiple sources explicitly describe malware being distributed via Steam Workshop uploads for Wallpaper Engine—specifically “application wallpapers” that can execute code (Sources 1, 2, 4, 7). The opponent's point that the abuse was limited to a particular wallpaper type and later mitigated (Source 9) does not contradict the core past-tense distribution claim, so the claim is true as worded though it omits that the issue was scoped to “application” items rather than all wallpaper types.