Hackers Exploit Steam Workshop to Spread Live Wallpapers Bundled With Cryptominers and Other Malware

Steam Workshop is a platform where gamers share game mods and other user-created content, while Wallpaper Engine lets users download live wallpapers. Kaspersky found that hackers were exploiting users’ trust in community creations to distribute malware. The threats can steal accounts and personal data and may also commandeer computer resources to mine cryptocurrency.

As of July 20, 2026, the identified malicious live wallpapers had accumulated tens of thousands of downloads and contained information stealers, backdoors and cryptocurrency-mining software. Steam has removed the wallpapers confirmed to be malicious, but Kaspersky said new malicious submissions continue to appear. Gamers should still carefully vet Workshop content before downloading it.