Loading story…
Attackers abused Steam Workshop’s Wallpaper Engine sharing feature to distribute malicious “application wallpapers” that executed code on Windows systems, primarily targeting gamers in China and Russia. Researchers found dozens of tainted wallpapers with thousands to tens of thousands of downloads each; one sample dropped DarkKomet-related malware as Synaptics.exe, installed a trojanized AggregatorHost.dll to hijack active Steam sessions, and exfiltrated stolen data to attacker-controlled infrastructure at 120.48.156[.]17.
The campaign focused on stealing Steam accounts but also delivered additional payloads including backdoors, infostealers, crypto miners, downloaders, and potentially ransomware. Researchers said the activity had been ongoing since late 2025, with about 89% of malicious download attempts occurring in China and 5.5% in Russia; Valve removed the identified wallpapers and related links after disclosure, though new infected uploads were still appearing.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
After the researchers disclosed their findings, Steam removed the identified malicious wallpapers and associated links from the platform. The report noted that new infected wallpapers continued to appear despite those removals.
Researchers found dozens of malicious wallpapers on Steam Workshop, with individual items showing thousands to tens of thousands of downloads. In one analyzed sample, a wallpaper dropped DarkKomet-related malware as Synaptics.exe, installed a trojanized AggregatorHost.dll to hijack active Steam sessions, and exfiltrated data to 120.48.156[.]17.
Since late 2025, attackers have used Steam Workshop's Wallpaper Engine sharing feature to distribute malicious application wallpapers that execute code on victims' Windows systems and steal Steam accounts. The campaign primarily targeted gamers in China and Russia and also delivered malware including backdoors, infostealers, crypto miners, downloaders, and potentially ransomware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
10 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcecybersecuritynews.com
Open sourcexakep.ru
Open sourcecommunity.gurucul.com
Open sourcekaspersky.co.uk
Open sourcebleepingcomputer.com
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
The **FBI** is seeking victims as it investigates a suspected cybercriminal who published multiple **malware-tainted games** on **Steam**, using seemingly legitimate titles as Trojan horses to infect players' systems. The games named by the agency include **BlockBlasters/BlockBasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova**, and were reportedly available between **2024 and 2026**. Both reports indicate the titles were functional enough to appear legitimate, but were designed to deliver malware and compromise users after installation. The reported impact includes **account compromise, information theft, and crypto-wallet draining**, with one cited case involving the theft of **$32,000 in cancer donations** from a streamer after exposure to one of the malicious games. The investigation suggests the listed titles may have been developed by the **same threat actor**, and that the number of affected users remains unknown. The case also highlights ongoing weaknesses in marketplace screening, as malicious games were able to reach Steam users before being removed by **Valve**.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026