Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk

What Happened

Hackers are hiding malicious software inside custom animated wallpapers shared on the Steam Workshop for the popular app Wallpaper Engine. This campaign primarily affects gamers in China and Russia who download these custom backgrounds. It matters because downloading these infected files can lead to stolen Steam account credentials, or leave computers infected with programs that secretly mine cryptocurrency or lock files for ransom. Users should be cautious when downloading interactive wallpapers and ensure their antivirus software is active and up to date.

Key Takeaways

• Attackers are exploiting Wallpaper Engine's 'application wallpapers' feature on Steam Workshop to distribute malware.
• The campaign primarily targets gamers in China (89%) and Russia, aiming to hijack Steam accounts.
• Malware payloads include DarkKomet, Lumma, Vidar infostealers, and the RenEngine loader.
• The attack chain involves dropping a backdoor (Synaptics.exe) and a patched system library (AggregatorHost.dll) to steal Steam session data.
• Stolen session credentials are exfiltrated to attacker-controlled C2 servers to hijack accounts and upload more malicious wallpapers.

Affected Systems

• Windows systems running Steam and Wallpaper Engine

Attack Chain

The victim downloads a malicious 'application wallpaper' from the Steam Workshop via Wallpaper Engine. Upon execution, the wallpaper drops a backdoor named Synaptics.exe into C:\ProgramData\Synaptics\ and launches ._cache_GAME1.exe. This secondary executable runs the benign game interface while simultaneously installing a patched AggregatorHost.dll. The modified DLL searches for steam.exe or steamchina.exe processes, hijacks the active Steam session, and exfiltrates the session credentials to an attacker-controlled C2 server.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Kaspersky

The article does not provide raw detection rules, but lists Kaspersky heuristic and generic detection verdicts (e.g., HEUR:Trojan-PSW.Win32.gen).

Detection Engineering Assessment

EDR Visibility: High — EDR solutions should easily detect the dropping of executables (Synaptics.exe) in ProgramData, the execution of unverified binaries from Steam Workshop directories, and anomalous process injection or memory reading targeting steam.exe. Network Visibility: Medium — Network monitoring can detect outbound HTTP connections to known C2 IPs or unusual domains, though Steam traffic itself is noisy. Detection Difficulty: Moderate — While the malware uses legitimate platforms (Steam) for delivery, the post-exploitation behavior (dropping executables in ProgramData, reading Steam process memory) is highly anomalous and detectable.

Required Log Sources

• Process Creation (Event ID 4688 / Sysmon Event ID 1)
• File Creation (Sysmon Event ID 11)
• Network Connections (Sysmon Event ID 3)

Hunting Hypotheses

Control Gaps

• Lack of application control/whitelisting for Steam Workshop executables
• Insufficient memory protection for user-mode applications like Steam

Key Behavioral Indicators

• Creation of AggregatorHost.dll in non-standard directories or with mismatched hashes
• Execution of files named ._cache_GAME1.exe
• Outbound HTTP requests to bare IP addresses from game-related processes

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• If applicable, block the identified C2 IP addresses and domains at the network perimeter.
• Search endpoint telemetry for the presence of 'Synaptics.exe' in the 'C:\ProgramData\Synaptics' directory.

Infrastructure Hardening

• Consider implementing application control policies to restrict the execution of unapproved binaries from user-writable directories.

User Protection

• Ensure endpoint antivirus and EDR solutions are active, updated, and configured to scan downloaded files.
• If Steam is permitted on corporate assets, consider restricting the use of Wallpaper Engine or its 'application wallpapers' feature.

Security Awareness

• Educate users about the risks of downloading executable content disguised as media or wallpapers from community workshops.

MITRE ATT&CK Mapping

• T1204.002 - User Execution: Malicious File
• T1036 - Masquerading
• T1539 - Steal Web Session Cookie
• T1059 - Command and Scripting Interpreter
• T1071.001 - Application Layer Protocol: Web Protocols

Additional IOCs

• Ips:
  • 120[.]48[.]156[.]17 - C2 server IP address
  • 202[.]144[.]192[.]29 - C2 server IP address
• Domains:
  • brightly[.]to - C2 domain
• Urls:
  • hxxp://202[.]144[.]192[.]29/audit.php - C2 endpoint
  • hxxp://202[.]144[.]192[.]29/download2/Themes2.zip - Payload hosting URL
  • hxxp://120[.]48[.]156[.]17/ey.php - C2 endpoint for exfiltration
  • hxxp://brightly[.]to/download2/Themes2.zip - Payload hosting URL
  • hxxps://www[.]dropbox[.]com/s/zhp1b06imehwylq/Synaptics.rar?dl=1 - Malicious payload hosted on Dropbox
  • hxxps://docs[.]google[.]com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download - Malicious payload hosted on Google Drive
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3603213159 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3591930233 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3584318845 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3436875036 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3633494498 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3556591375 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3635875825 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3601924072 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3605588743 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3553253793 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3462675635 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3605621824 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3610240788 - Malicious Steam Workshop wallpaper URL
  • hxxps://steamcommunity[.]com/sharedfiles/filedetails/?id=3610366547 - Malicious Steam Workshop wallpaper URL
• File Hashes:
  • 95856f2ce428c728d9781d3296558068 (MD5) - Malicious file hash associated with the campaign
  • af080780cca2acd1d082ce01e7cc346a (MD5) - Malicious file hash associated with the campaign
  • c133c3dd9f7d6934598025047df41abf (MD5) - Malicious file hash associated with the campaign
  • d1693bbff456ae8fa3360446706df6da (MD5) - Malicious file hash associated with the campaign
  • 8c2cc585ad8a13a72a704c0fda0c9854 (MD5) - Malicious file hash associated with the campaign
  • b9fa763a53da3eea742d0f3c845a8c09 (MD5) - Malicious file hash associated with the campaign
  • ded08ae5df7f1b12e5fdb767dbbed0b1 (MD5) - Malicious file hash associated with the campaign
  • 20965254e29104986e11939decd39549 (MD5) - Malicious file hash associated with the campaign
  • 18dedc0009f0927cba6425c84cce9883 (MD5) - Malicious file hash associated with the campaign
  • 0f4f01c6d495abb37403072dd017ce8d (MD5) - Malicious file hash associated with the campaign
  • 5620f01284329f561b1839a36be55355 (MD5) - Malicious file hash associated with the campaign
  • fe1f6485013cd5e6d5cf718049b0b8d6 (MD5) - Malicious file hash associated with the campaign
  • 74414ed4b63aadec039b603c32762b80 (MD5) - Malicious file hash associated with the campaign
• File Paths:
  • C:\ProgramData\Synaptics\Synaptics.exe - Path where the DarkKomet backdoor is dropped.