Dozens of application wallpapers for Wallpaper Engine on Steam Workshop carried malware that could hijack Steam accounts and install backdoors or crypto miners on Windows systems.
Each malicious package had been downloaded thousands or tens of thousands of times since late 2025, primarily targeting gamers in China and Russia and exposing a significant portion of Wallpaper Engine's active Windows audience.
Wallpaper Engine Infection Mechanism
A December 2025 wallpaper sample for Wallpaper Engine appeared harmless on the surface—the built‑in game booted up flawlessly and desktop controls worked as expected—while the package, running on Windows, dropped components that executed within just a few minutes and could steal a live Steam session or cripple the computer with backdoors and crypto miners.
Steam Workshop Spread Since late 2025
Since late 2025 attackers have exploited Steam Workshop's sharing feature to publish dozens of malicious application wallpapers that each accumulated thousands or tens of thousands of downloads, and because Wallpaper Engine averages 100,000 daily active users and has nearly a million reviews the campaign reached a large, active Windows user base.
DarkKomet and Synaptics.exe Details
The compromised packages dropped a backdoor file named Synaptics.exe that belongs to the DarkKomet malware family and also launched an executable called._cache_GAME1.exe to boot a bundled game named NTRaholic while installing a custom AggregatorHost.dll whose payload searched the system for the Steam app, harvested account credentials, hijacked live Steam sessions and transmitted the collected data to a server controlled by the attackers.
Windows users who installed application wallpapers from Steam Workshop should check their systems for files named Synaptics.exe or._cache_GAME1.exe and for an AggregatorHost.dll outside normal Steam files, treat such files as indicators of compromise, disconnect the machine from networks and change Steam account credentials from a different, clean device.
How many Steam accounts were actually hijacked by the malicious wallpapers?
