Kaspersky discovered a malware campaign targeting Steam users through wallpaper

[Karl_3000]

The malware is contained in a wallpaper app, Steam Workshop and Wallpaper Engine, a popular Steam application used to create and share animated desktop wallpapers.

People  using Steam in China and Russia were the primary targets while some people in other countries like Singapore, Hong Kong, Germany, Vietnam, India and Canada are also targeted. The main goal of the attackers was stealing gaming accounts and deploying additional malware.

I think it is a Windows malware
The application-based wallpaper feature allows executable programs to run directly on a user's Windows computer, allowing attackers to distribute malicious software under the guise of legitimate content. Kaspersky identified dozens of infected wallpaper packages available through Steam Workshop. Many of these packages had thousands or even tens of thousands of downloads.

Independent actors were likely involved than a single group of people.

"Trusted platforms can be abused to distribute malware: the attacks rely on users trusting content hosted within legitimate ecosystems. While many of the malware families involved are well-known, the delivery mechanism enables attackers to reach large numbers of potential victims through seemingly harmless content," commented Maxim Starodubov, a cybersecurity expert at Kaspersky.

Important information to avoid malware from Kaspersky
Exercise caution when downloading any application, even from trusted sources
Verify the reputation and legitimacy of content creators before installing any user-generated content
Rely on proven cybersecurity solutions to detect threats

https://www.kaspersky.co.uk/about/press-releases/kaspersky-discovered-a-malware-campaign-targeting-steam-users-through-infected-wallpaper

[albon]

I've seen quite a few scams involving Steam Workshop, where malicious developers/Users exploit the trust people place in these platform by uploading harmful content containing malware, and the problem is that many people assume everything published on Steam is automatically safe. They need to know that user-generated content isn't always safe. It's even riskier when such content gets installed on a computer that contains sensitive data such as crypto or other important information.

It is the responsibility of every user to scan downloaded content for malware, check the uploader's reputation and read reviews and comments before installing it. It's also a good idea to use a separate computer for gaming or to test anything in a virtual machine such as VMware.