Malware Targeting Steam Gamers Uses Anime Wallpapers to Steal Crypto

Researchers from Kaspersky have identified malicious downloads on Steam Workshop that are disguised as animated wallpapers featuring anime characters. These wallpapers, which utilize the Wallpaper Engine, can execute programs on users' Windows computers, allowing cybercriminals to distribute various types of malware.

The identified malware includes Lumma and Vidar infostealers, known for stealing sensitive information such as credentials and cryptocurrency wallet data. Kaspersky noted that many of these wallpaper packages have thousands, or even tens of thousands, of downloads, indicating a wide reach of this malicious campaign. Targeted countries include China, Russia, Singapore, Hong Kong, Germany, Vietnam, India, and Canada.

A concerning aspect of this campaign is how attackers bundle malware either directly in the wallpaper download or within password-protected archives that extract malicious files during installation. For instance, in a 2025 case, a wallpaper appeared to launch a legitimate game while secretly installing the DarkKomet backdoor onto affected systems.

Kaspersky researcher Maxim Starodubov comments on the implications of these findings, stating, "Trusted platforms can be abused to distribute malware: The attacks rely on users trusting content hosted within legitimate ecosystems." This reinforces the need for users to exercise caution even on reputable platforms like Steam, as attackers increasingly exploit user trust in these environments.

This report adds to a series of malware incidents targeting Steam users, emphasizing the importance of cybersecurity vigilance among gamers, particularly those holding cryptocurrency assets.