5 ms·
Gamers beware: malicious wallpapers on Steam found stealing accounts
- beart 5mo agoSo this vulnerability isn't directly the result of using Steam, or any of the Steam profile customizations, such as avatars and profile page backgrounds. But rather, it is a vulnerability in a third-party application "Wallpaper Engine" which is available on Steam. I recall when screen savers were a common malware vector on Windows. I suppose everything old is new again.
- fckgw 5mo agoThe malicious wallpapers, which use "Wallpaper Engine" are also published through Steam Workshop. It's still a Steam problem.
- gchamonlive 5mo agoIrrelevant comment, op said "this vulnerability isn't directly the result of using Steam", not that steam doesn't share responsibility
- wccrawford 5mo agoIt said they are "on Steam" which is true. They are distributed through the Steam Workshop, which Valve runs and attempts to protect from abuse. While it's not as high-profile as the official profile backgrounds and avatars, it's still in an area that most gamers would think was safe by default, since Valve moderates it.
- gchamonlive 5mo agoIt's true, just irrelevant
- nottorp 5mo agoFirst thing I thought of when I saw the title was "since when does Steam have wallpapers?". The article is at the least titled misleadingly and an attempt to sell fear.
- wnevets 5mo agoWhy do you need an "Engine" for wallpapers in the first place?
- nosioptar 5mo agoOpensuse (pre 11 iirc) used to have a really cool background where the lighting changed throughout the day, that probably used an engine of some sort.
- wongarsu 5mo agoBecause they are not static images. That's the whole gimmick
- jjmarr 5mo agoSo you can have an animated or interactive "wallpaper". The malicious wallpapers in the OP are hentai games.
- some_random 5mo agoBecause it's one of the only ways to get porn in China
- _--__--__ 5mo agoThe 'wallpapers' in question are pirated games made in renpy (python game engine) or rpgmaker (js based), which makes them a really good vector for malware. As another commenter noted this is a bizarrely common way for Chinese people to get porn through the great firewall.
- tsol 5mo agoWhy would that be the only way to get porn that they don't crack down on?
- wincy 5mo agoI use them because they look nice and with an OLED I wanted a dynamic wallpaper so I wouldn’t get screen burn in. There is adult stuff but everything I use is just video games and matrix scrolling patterns, that kind of stuff, so I can tell my monitor is on without getting burn in. I’ve got a high end desktop so can take the minor performance hit running it all the time. Unfortunately seems like I’m going to be uninstalling it.
- raincole 5mo agoIt's not completely unrelated to Steam though. The malicious code is delivered by Steam Workshops. It might or might not be justified to put 'Steam' on the title, but it's par on HN standards (people always put 'npm' on the titles when there is a supply chain issue.)
- ASalazarMX 5mo agoI'm still waiting for the new generations to rediscover screen savers.
- jjmarr 5mo agoI love how the post is clearly written by AI. A human might've noticed all the screenshots appear to be of interactive hentai games distributed through Wallpaper Engine. And wouldn't have said: > On the surface, this wallpaper sample (above) we uncovered in December 2025 looks completely harmless. In reference to a screenshot of an anime woman with ripped clothes, eyes in fear, being monitored by CCTV camera. From my knowledge, "adult entertainment" is targeted by malware because it's socially embarrassing to admit that was the attack vector. It's relevant to point that out.
- jmuguy 5mo agoCentipedes? In my waifu?!
- jerf 5mo agoSexual arousal also tends to inhibit rational thought. I don't mean that in a snarky or sarcastic way, I mean that it is a biological process that has been well-studied and well-established [1]. This has obvious uses for scamming people and doing other things that their executive function might normally catch and prevent. This is also why sexual imagery should generally be kept out of public spaces, not because of "puritanism" but because it just generally isn't a good idea to go around letting bad actors inhibiting people's executive function willy-nilly. That should generally be denied as a tool to bad actors like scammers. [1]: For instance https://people.duke.edu/~dandan/webfiles/PapersPI/Sexual%20Arousal%20and%20Decision%20making.pdf https://people.duke.edu/~dandan/webfiles/PapersPI/Sexual%20A... - note while the title mentions "sexual decision making" it also covers some 'bad decisions' that aren't particularly sexual on their own.
- mrguyorama 5mo ago>This is also why sexual imagery should generally be kept out of public spaces, not because of "puritanism" but because it just generally isn't a good idea to go around letting bad actors inhibiting people's executive function willy-nilly Okay but presumeably humans adapt to the level of "sexuality" around them to some degree (like they do nearly every other stimulus), because otherwise you could show less prude cultures having lower ability to do "rational thought". Nudity is normal all over the world and yet people seem to function just fine. What constitutes content that justifies sexual arousal is socially constructed!
- ApolloFortyNine 5mo agoWallpaper Engine is pretty old now, and I remember using it years ago reading warning about not downloading unknown wallpapers. I believe there's even settings in the configuration not to run arbitrary code. 8 year old post about it, but honestly pretty sure it's been warned since day 1. [1] [1] https://www.reddit.com/r/wallpaperengine/comments/7xg27d/remote_access_alert/ https://www.reddit.com/r/wallpaperengine/comments/7xg27d/rem...
- wxw 5mo ago> The whole concept of “application wallpapers” essentially allows foreign code to be run directly on your computer. Cybercriminals took note of this feature and started embedding malware right into these types of wallpapers. > Because Wallpaper Engine relies on Steam Workshop for content sharing, anyone can create a wallpaper and publish it for the community to download and install for free. RIP