A live wallpaper on your desktop sounds harmless. In 2026 it hasn’t been. Kaspersky researchers spent mid-year tracking a campaign that hid the DarkKomet backdoor inside infected Wallpaper Engine content distributed through Steam Workshop, quietly harvesting account data and hijacking active Steam sessions while the animated background kept running in the taskbar. Around the same period, a separate cluster of malicious library files (AggregatorHost.dll) turned Workshop uploads into a distribution channel for credential theft and crypto-wallet draining. Search interest in “wallpaper engine malware” spiked to 8,100 monthly queries in June 2026 before settling near 900, according to Google Ads data, which tells you two things: the threat was real enough to make headlines, and a lot of people still don’t know how to check whether they got hit.
This tutorial walks through exactly how to detect, remove, and prevent Wallpaper Engine and Steam Workshop malware on a Windows PC, step by step. You’ll build a small detection toolkit, learn the specific file and registry indicators tied to the 2026 campaigns, lock down Steam Guard and Workshop permissions, and set up ongoing monitoring so a repeat infection doesn’t slip past you. Total time: about 90 minutes for the full pass, with the core cleanup steps taking 20-30 minutes on their own.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why Wallpaper Engine and Steam Workshop Became a Malware Vector in 2026
Wallpaper Engine is a legitimate, popular Steam application (over 60,000 monthly searches for the product itself) that lets users run animated backgrounds, some of which are built as small interactive programs rather than static video loops. That flexibility is exactly what attackers abused. Older versions of the app supported “application wallpapers,” essentially bundled executables, uploaded through Steam Workshop with no meaningful vetting beyond automated scans. Kaspersky’s mid-2026 report described a campaign where an infected wallpaper deployed the DarkKomet backdoor and a modified library that harvested Steam account information and hijacked active sessions, all while the visual wallpaper played normally so the victim had no reason to suspect anything.
A parallel threat advisory from Hive Pro documented a malicious AggregatorHost.dll library spreading through the same Workshop ecosystem, built to search for stored Steam credentials, hijack active sessions, exfiltrate browser data, and pull cryptocurrency wallet information off the infected machine. Separately, the FBI opened a victim-notification effort in March 2026 tied to a cluster of malicious Steam game listings, including titles publicly named as BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi, and Tokenova, used to spread malware directly through Valve’s storefront rather than the Workshop.
Wallpaper Engine’s own developers eventually responded by pulling the feature that made this possible, confirming on the official Steam community forum that affected uploads had already been banned and automatically deleted from disk, a statement you can read in full on the Wallpaper Engine Steam community discussion.
That removal closes the door on new application-wallpaper uploads, but it does nothing for machines that installed infected content before the change, or for the adjacent threats still active on Steam and Discord in September 2026: fake FACEIT verification pages, Discord token stealers like VVS Stealer, and the anti-cheat kernel driver flaws disclosed this year. This guide covers all of it as one connected cleanup and hardening project, because on a typical gaming PC these attack paths overlap.
Prerequisites and Tools You’ll Need
You don’t need paid security software to complete this tutorial. Everything below is free, and most of it comes directly from Microsoft or is a widely trusted open-source tool. Confirm you have the following before starting:
- Windows 10 (22H2 or later) or Windows 11 (23H2 or later), with admin rights on the account you’re using
- Microsoft Defender enabled and updated (or a third-party AV of your choice, fully updated)
- Autoruns v14.11+ from Sysinternals, for inspecting startup items and scheduled tasks
- Process Explorer v17.06+ from Sysinternals, for live process and DLL inspection
- A VirusTotal account (free tier is enough) for hash and file lookups at virustotal.com
- Steam client updated to the current build, with Steam Guard Mobile Authenticator already installed on your phone (or ready to install in Step 8)
- Wallpaper Engine, if installed, updated to its current Steam build (the version that removed application wallpapers)
- About 2GB of free disk space for temporary scan logs and quarantine folders
- 15-20 minutes of uninterrupted time for the full scan pass, since some steps require a reboot
If you manage multiple household or LAN-party PCs, plan to repeat Steps 1 through 6 on each machine individually. Malware that hijacks a Steam session can propagate through shared Workshop subscriptions and friend invites, so a single missed machine can reinfect the rest of your network.
Step 1: Confirm Whether You’re Actually Infected
Before you start ripping out files, spend five minutes checking for the specific indicators tied to the 2026 campaigns. Don’t skip this step and jump straight to a factory reset. Most infections are recoverable without wiping the machine, and you’ll want the evidence intact if you later need to file a report with Steam Support or your bank.
Open Task Manager (Ctrl+Shift+Esc), click “More details,” and sort the Processes tab by CPU and then by Network. Look for processes you don’t recognize consuming background CPU or network bandwidth while no game or wallpaper is actively rendering. The AggregatorHost.dll campaign documented by Hive Pro specifically loads into legitimate-looking host processes, so a strange name isn’t always required, unusual behavior from a normal-looking process is just as suspicious.
Next, check your Steam login history. Open Steam, go to your account details page, and review “Manage Steam Guard Account Security,” which lists recent authorizations. If you see a login from a device or location you don’t recognize, treat that as a confirmed compromise and skip ahead to Step 8 (account lockdown) before finishing the malware scan, since an active session hijack needs to be cut off immediately.
Step 2: Run a Full Autoruns Scan for Persistence Mechanisms
Malware that survives a reboot has to register itself somewhere: a registry Run key, a scheduled task, a service, or a browser extension. Autoruns catches all of these in one pass, which is why it’s the first real tool in this workflow.
# Run as Administrator from an elevated PowerShell prompt
# Download and launch Autoruns (Sysinternals Suite)
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Autoruns.zip" -OutFile "$env:TEMP\Autoruns.zip"
Expand-Archive -Path "$env:TEMP\Autoruns.zip" -DestinationPath "$env:TEMP\Autoruns" -Force
Start-Process "$env:TEMP\Autoruns\Autoruns64.exe" -Verb RunAsOnce Autoruns opens, go to Options and enable “Hide Microsoft Entries” and “Verify Code Signatures.” This filters out the noise and leaves you looking mostly at third-party entries, which is exactly where malicious persistence hides. Pay close attention to the Logon, Scheduled Tasks, and Services tabs. Any unsigned entry pointing to a path inside your Wallpaper Engine content folder (usually %ProgramFiles(x86)%\Steam\steamapps\workshop\content\431960\) or referencing a random-looking DLL name should be treated as suspect.
Right-click any suspicious entry and choose “Search Online” or copy the file’s hash for a manual VirusTotal lookup. Do not delete anything yet, just flag it. You want a complete list before you start removing things, since some malware families re-register a second persistence entry as a fallback if the first one is deleted alone.
Step 3: Inspect Running Processes With Process Explorer
Autoruns tells you what’s set up to run. Process Explorer tells you what’s actually running right now, including DLLs loaded into otherwise-legitimate processes, which is how the AggregatorHost.dll campaign operates.
Start-Process "$env:TEMP\Autoruns\procexp64.exe" -Verb RunAs
# In Process Explorer: View > Lower Pane View > DLLs
# Then click any process to inspect its loaded modules in the lower paneClick through processes tied to Steam (steam.exe, steamwebhelper.exe) and your Wallpaper Engine process (wallpaper32.exe or wallpaper64.exe) and inspect the DLLs panel underneath. Look specifically for a module named AggregatorHost.dll or any DLL with no company name and no digital signature loaded into these processes. Right-click the suspicious module and select “Check VirusTotal” directly from the context menu, this submits the hash automatically without uploading the full file.
If Process Explorer shows a network connection icon (the color-coded highlighting under View > Select Columns > Process Performance) on a process that has no business making outbound connections, like the wallpaper renderer, note the remote IP and add it to your findings. You’ll block it at the firewall level in Step 6.
Step 4: Scan and Quarantine With Microsoft Defender Offline
Standard Defender scans run inside the OS you’re trying to clean, which some rootkit-style droppers can detect and evade. Defender Offline boots a minimal environment before Windows loads, which is how you catch the persistence mechanisms that hide from a live scan.
# Trigger Microsoft Defender Offline scan from an elevated PowerShell prompt
Start-MpWDOScan
# Alternatively, from Windows Security UI:
# Windows Security > Virus & threat protection > Scan options >
# Microsoft Defender Offline scan > Scan nowThe machine will reboot into a blue scanning screen and run for 15-20 minutes before restarting into Windows normally. When it’s done, check the scan history under Windows Security > Protection History. Any detection tagged as a downloader, backdoor, or stealer family (DarkKomet variants are commonly flagged under names like Backdoor:Win32/Fynloski or similar Defender aliases) confirms the infection and shows you the exact file path that was quarantined.
If Defender finds and quarantines something, don’t restore it. Note the file path from the detection log, cross-reference it against what you flagged in Steps 2 and 3, and move to Step 5 to clean up the associated Workshop content.
Step 5: Remove Infected Steam Workshop Content and Reinstall Clean
A malware scanner clears the payload but won’t necessarily remove the Workshop subscription that keeps re-downloading it. Steam will happily re-sync a previously-subscribed Workshop item on next launch, which can reintroduce the same infected file within minutes of a clean scan.
In Steam, open your Workshop subscriptions from your profile page (Profile > Items or the Workshop tab within Wallpaper Engine itself). Unsubscribe from anything you didn’t personally search for and choose deliberately, especially wallpapers or mods you installed from a link shared in a Discord server or forum post rather than found through in-app search. Then manually delete the local content cache:
# Close Steam completely first (right-click tray icon > Exit)
# Default Workshop content path for Wallpaper Engine (AppID 431960)
Remove-Item -Path "C:\Program Files (x86)\Steam\steamapps\workshop\content\431960\*" -Recurse -Force
# Also clear the general Workshop downloads cache
Remove-Item -Path "C:\Program Files (x86)\Steam\steamapps\workshop\downloads\*" -Recurse -ForceAdjust the drive letter and path if Steam is installed elsewhere; check your Steam library folder settings if unsure. After clearing the cache, relaunch Steam, let it verify, then reinstall Wallpaper Engine’s client through Steam’s normal install flow so you’re on the current build, the one that removed application-wallpaper support entirely following the developers’ policy change.
Step 6: Block Malicious Network Indicators at the Firewall
If Step 3 turned up a suspicious outbound IP, or if Defender’s detection log includes a command-and-control domain, block it at the Windows Firewall level so any remaining dormant component can’t phone home even if the scan missed a file.
# Replace the IP with the address you identified in Step 3
New-NetFirewallRule -DisplayName "Block-Suspicious-C2" `
-Direction Outbound -Action Block `
-RemoteAddress 203.0.113.45 -Enabled True
# Verify the rule was created
Get-NetFirewallRule -DisplayName "Block-Suspicious-C2" | Format-ListIf you don’t have a specific IP to block but want general protection against this class of threat, consider enabling Defender’s “Block executable content from email client and webmail” and “Block untrusted and unsigned processes that run from USB” Attack Surface Reduction rules through Group Policy or PowerShell, both help against the sideloaded-DLL pattern used in the AggregatorHost.dll campaign.
Step 7: Check for the FACEIT and Steam Verification Phishing Pattern
Malwarebytes documented a separate but related campaign in June 2026 targeting competitive gamers on platforms like FACEIT. Fake “verification” pages hosted on lookalike domains, including faceit-discord.com and faceit-clubs-verify.com, trick players into entering Steam credentials, which attackers then use to take over accounts and manipulate item trades.
Review your browser history for the past 30 days for any domain resembling a service you use but not matching its real address (FACEIT’s genuine domain is simply faceit.com, with no hyphenated prefix). If you find a match, assume your Steam password was entered on that page and treat your account as compromised, proceed straight to Step 8. Malwarebytes’ incident writeup recommends the same immediate response used for any credential-phishing hit: change your Steam password, confirm Steam Guard is active, sign out of every other device, and review your trade and purchase history for anything you didn’t authorize. You can read the full breakdown on the Malwarebytes threat intelligence blog.
Step 8: Lock Down Steam Guard and Rotate Credentials
Whether or not Steps 1-7 turned up a confirmed infection, this step is worth doing unconditionally given how active the current threat landscape is around Steam accounts specifically.
- Open Steam > Account Details > Manage Steam Guard Account Security and confirm the Mobile Authenticator is active, not email-based Steam Guard, which is weaker against phishing.
- Change your Steam password from a device you’re confident is clean, ideally your phone, not the PC you just scanned.
- Go to steamcommunity.com/my/tradeoffers and review pending trade offers, cancel anything you don’t recognize.
- Check “Manage Steam Guard Account Security” for recent device authorizations and revoke any you don’t recognize.
- Regenerate your Steam API key if you use one for bots or trading tools, since old keys remain valid until manually revoked.
Full setup instructions for Steam Guard’s mobile authenticator and Discord’s own two-factor options are covered in more depth in our Steam Guard and Discord 2FA setup guide, worth a full read if you haven’t enabled hardware-backed or app-based 2FA on both platforms yet.
Step 9: Audit Discord for Token Stealer Activity
The malware ecosystem around gaming platforms in 2026 doesn’t stop at Steam. VVS Stealer, a Python-based information stealer sold on Telegram since at least April 2025, specifically targets Discord by locating encrypted tokens stored in LevelDB directories under a known prefix, decrypting them via Windows DPAPI, then querying Discord’s API to pull account details, billing information, Nitro status, and 2FA settings. Security Affairs’ full technical breakdown is available at securityaffairs.com, and researchers note the malware carries a built-in expiration date of October 31, 2026, meaning current campaigns are actively running right now, not historical.
In Discord, go to User Settings > Authorized Apps and revoke anything you don’t actively use. Then check Settings > Devices under your account security page for sessions logged in from unfamiliar locations, and log those out remotely. Enable an authenticator-app-based 2FA rather than SMS if you haven’t already, since SIM-swap attacks bypass SMS codes trivially. The single most common vector reported for token theft in current case files is running cheats, “free Nitro” generator tools, or unsolicited installers sent through DMs, so treat any executable received that way as hostile by default, regardless of who appears to have sent it, since a compromised friend’s account is a common delivery method.
Step 10: Check Your Anti-Cheat Drivers for Kernel-Level Vulnerabilities
Anti-cheat software runs at the kernel level by design, which makes any flaw in it a serious privilege-escalation risk rather than just an application-level bug. A 2026 technical disclosure documented a live local privilege escalation zero-day in the XIGNCODE3 anti-cheat driver, tracked as CVE-2026-3609, affecting the xhunter1.sys driver across versions 10.0.10011.16384 through 2023.12.7.78. A second flaw, CVE-2026-15430, was assigned to the newer xhunter2.sys v2026.6.1.192 driver shipping in more recent titles.
Run the check below to identify which anti-cheat kernel drivers are currently loaded on your system, then cross-reference the version against the CVE details published in the full technical writeup at blacksnufkin.github.io.
# List all currently loaded kernel drivers with file version info
Get-WmiObject Win32_SystemDriver | Where-Object { $_.PathName -match "xhunter" } |
ForEach-Object {
$path = $_.PathName -replace '\\SystemRoot','C:\Windows' -replace '"',''
Get-Item $path | Select-Object Name, VersionInfo
}If the query returns a driver version within the affected ranges, check the publisher’s site for the specific game title for a patched anti-cheat build, most vendors ship the fix as a silent update the next time the game launches, but a manual verification through Steam’s “Verify integrity of game files” option (right-click the game > Properties > Installed Files) forces the check immediately rather than waiting for the game’s own updater.
Step 11: Set Up Ongoing Monitoring So You Catch the Next One Early
A one-time cleanup doesn’t prevent reinfection. Given that the Workshop threat landscape shifts every few months, as shown by the search volume for “wallpaper engine malware” spiking to 8,100 in June 2026 before dropping back to under 1,000, set up lightweight ongoing checks rather than relying on remembering to rescan manually.
# Create a scheduled weekly Autoruns export for comparison over time
$action = New-ScheduledTaskAction -Execute "$env:TEMP\Autoruns\autorunsc64.exe" `
-Argument "-a * -c -h -s -o C:\SecurityLogs\autoruns-weekly.csv"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 9am
Register-ScheduledTask -TaskName "WeeklyAutorunsAudit" -Action $action -Trigger $trigger -RunLevel HighestDiff each week’s CSV export against the previous one (a simple Compare-Object call in PowerShell works fine for this) and you’ll catch new persistence entries within a week of them appearing, well before most stealer malware finishes its data collection window. Pair this with Defender’s scheduled quick scans (already on by default in most builds) and a monthly full scan, and you’ve closed the gap that let the June 2026 campaign run undetected on many machines for weeks.
Step 12: Harden Steam Workshop Settings Against Future Exposure
The last step is prevention rather than cleanup. Steam’s own family and content controls, originally built for parental use, double as a useful restriction on Workshop content for any account.
- In Steam Settings > Family, review content restrictions if the account is shared, and disable third-party executable content where the option exists per title.
- In Wallpaper Engine’s own in-app settings, disable “Automatically subscribe to Workshop updates” and instead manually review each update before installing it.
- Only install Workshop content that has a meaningful number of subscribers and recent, substantive comments, a wallpaper or mod with zero engagement and a suspiciously generic description is a common pattern for freshly-uploaded malicious content.
- Keep Wallpaper Engine and Steam themselves updated automatically rather than deferring updates, since the fix that removed application-wallpaper support only protects you once installed.
For a broader look at securing PC gaming setups end to end, including Minecraft server hardening, our Minecraft server security guide covers the server-side equivalent of this same threat model, malicious mods and plugins used as a delivery mechanism.
Common Pitfalls to Avoid
A handful of mistakes come up repeatedly when people attempt this cleanup on their own, and each one either leaves the infection partially intact or creates a false sense of security.
- Deleting the visible malware file without removing its Workshop subscription. Steam re-downloads subscribed content automatically, reintroducing the same file within minutes.
- Changing your Steam password from the infected machine. If a keylogger or clipboard-monitoring component is still active, your new password gets captured immediately. Always rotate credentials from a separate, confirmed-clean device.
- Assuming a clean quick scan means you’re safe. Standard Defender quick scans skip large portions of the file system by design. Always run a full or offline scan after a suspected compromise, not just the default quick scan.
- Ignoring Discord because the infection came through Steam. Credential-stealing malware routinely harvests everything accessible on the machine, not just the app it entered through. Treat every account with saved credentials on that PC as potentially exposed.
- Restoring a file from quarantine to “check if it’s really infected.” This is more common than it sounds and it reintroduces the exact payload you just removed.
- Skipping the anti-cheat driver check because “the game runs fine.” Kernel-level vulnerabilities in anti-cheat software don’t affect gameplay, they affect privilege escalation, which is invisible during normal play.
- Not checking other household PCs on the same network. Shared Workshop subscriptions and Discord server memberships mean one infected machine can reintroduce threats to devices you already cleaned.
- Using SMS-based two-factor instead of an authenticator app or hardware key. SIM-swapping defeats SMS codes, and it remains a common technique paired with credential-stealing malware campaigns.
Expected Output at Each Stage
Here’s what a clean pass through this workflow should look like, so you know whether your results match expectations or indicate a problem needing more digging.
| Step | Clean Result | Result Needing Further Action |
|---|---|---|
| Autoruns scan (Step 2) | Only signed, recognized entries remain after filtering Microsoft entries | Unsigned entry pointing to Workshop content path or unfamiliar temp folder |
| Process Explorer DLL check (Step 3) | All loaded modules show a verified company name and signature | Unsigned DLL loaded into steam.exe, steamwebhelper.exe, or wallpaper64.exe |
| Defender Offline scan (Step 4) | “No threats found” in Protection History | Any detection tagged Backdoor, Trojan:PythonStealer, or similar in scan history |
| Workshop content review (Step 5) | Subscriptions list matches only content you deliberately chose | Unrecognized subscriptions or items shared via external links/Discord |
| Anti-cheat driver check (Step 10) | Driver version falls outside CVE-2026-3609 / CVE-2026-15430 ranges | Version matches an affected range; game hasn’t shipped a patched build yet |
Troubleshooting Common Issues
Autoruns won’t launch or crashes immediately after download. Windows SmartScreen sometimes blocks unsigned Sysinternals downloads on first run. Right-click the executable, select Properties, and check “Unblock” at the bottom of the General tab before launching again.
Defender Offline scan won’t complete and the PC reboots into Windows normally without finishing. This usually means a UEFI Secure Boot conflict or insufficient free disk space for the offline scan environment. Free up at least 3GB and confirm Secure Boot is enabled (not just Legacy/CSM mode) in BIOS before retrying.
Steam won’t let you delete Workshop content because “Steam is running.” Some Workshop files stay locked by the Steam Client Service even after you close the main window. Fully exit via the system tray icon, or stop the “Steam Client Service” in Windows Services (services.msc) before retrying the delete command.
VirusTotal flags a file as clean but you still suspect it. A single clean scan doesn’t guarantee safety, especially for a newly modified variant that hasn’t propagated to threat-intel feeds yet. Cross-reference the file’s behavior (network connections, registry writes) using Process Explorer rather than relying on signature detection alone.
The suspicious IP you tried to block in Step 6 keeps changing. Some stealer malware uses domain generation algorithms or rotates through cloud hosting providers specifically to defeat static IP blocks. In that case, block at the DNS level instead, using a filtering resolver, since domains change less frequently than the IPs behind them.
Steam Guard Mobile Authenticator won’t transfer to a new phone. You need the Steam Guard recovery code generated when you originally set up the authenticator, found in your account’s Steam Guard settings before removal. Without it, Steam requires a support ticket with proof of purchase history, which can take several days to resolve.
Discord shows a login you don’t recognize but you can’t identify the location. Discord’s device list shows an approximate location based on IP geolocation, which can be inaccurate for VPN users or mobile carriers using carrier-grade NAT. If you use a VPN yourself, cross-reference the timestamp against your own usage before assuming compromise, but when in doubt, log the session out and rotate your password anyway.
The scheduled Autoruns task from Step 11 never runs. Check that the task is set to “Run whether user is logged on or not” and that the account used has the necessary privileges, tasks created under a standard user account without elevation silently fail to execute the elevated Autoruns command.
Anti-cheat software won’t launch after a driver update. This sometimes happens when a game’s anti-cheat driver conflicts with another kernel-level security tool (a rival anti-cheat, some VPN kernel drivers, or virtualization-based security features). Try temporarily disabling Memory Integrity (Windows Security > Device Security > Core Isolation) to confirm whether that’s the conflict, then report it to the game’s support channel rather than leaving Memory Integrity permanently off.
Advanced Tips for Power Users and Small Gaming Communities
If you run a Discord server or LAN community and want to protect members beyond your own machine, a few extra steps pay off disproportionately. Set up a server rule requiring any shared executable or installer link to go through a designated verified-content channel, moderated by trusted members, rather than allowing direct DMs or general-chat links, since DM-based delivery remains the single most reported vector for both Discord token stealers and Workshop-adjacent malware.
For anyone managing several PCs (an internet cafe, a LAN center, or a household with kids sharing accounts), consider building a simple hash-allowlist using PowerShell’s Get-FileHash against a known-good baseline taken right after a clean install, then running a weekly comparison. This catches unauthorized file modifications faster than signature-based antivirus alone, since it doesn’t depend on the malware already being known to a vendor’s threat database.
# Build a baseline hash list of your Wallpaper Engine content folder
Get-ChildItem -Path "C:\Program Files (x86)\Steam\steamapps\workshop\content\431960" -Recurse -File |
Get-FileHash -Algorithm SHA256 |
Export-Csv -Path "C:\SecurityLogs\workshop-baseline.csv" -NoTypeInformation
# Re-run weekly and compare against the baseline to spot unauthorized changes
$current = Get-ChildItem -Path "C:\Program Files (x86)\Steam\steamapps\workshop\content\431960" -Recurse -File | Get-FileHash -Algorithm SHA256
$baseline = Import-Csv "C:\SecurityLogs\workshop-baseline.csv"
Compare-Object -ReferenceObject $baseline -DifferenceObject $current -Property HashIf you’re comfortable writing your own detection signatures, our YARA rules guide walks through creating custom rules that catch variants of these stealer families even before vendor signatures update, useful if you’re managing security for a gaming community or small business network rather than just a personal PC.
Complete Working Project: A Full Cleanup and Monitoring Script
Bringing everything together, here’s a consolidated PowerShell script that runs the detection portion of this workflow (Steps 1-3 and the network check from Step 6) in a single pass, producing a report file you can review or share with a more experienced friend if you want a second opinion.
# wallpaper-engine-security-check.ps1
# Run as Administrator. Produces a report at C:\SecurityLogs\scan-report.txt
$reportPath = "C:\SecurityLogs"
New-Item -ItemType Directory -Path $reportPath -Force | Out-Null
$report = "$reportPath\scan-report.txt"
"=== Wallpaper Engine / Steam Workshop Security Check ===" | Out-File $report
"Run at: $(Get-Date)" | Out-File $report -Append
"`n--- Suspicious Processes (High CPU/Network, Unsigned) ---" | Out-File $report -Append
Get-Process | Where-Object { $_.Path -and (Get-AuthenticodeSignature $_.Path).Status -ne "Valid" } |
Select-Object Name, Id, Path | Out-File $report -Append
"`n--- Anti-Cheat Driver Versions ---" | Out-File $report -Append
Get-WmiObject Win32_SystemDriver | Where-Object { $_.PathName -match "xhunter" } |
ForEach-Object {
$path = $_.PathName -replace '\\SystemRoot','C:\Windows' -replace '"',''
if (Test-Path $path) {
$vi = (Get-Item $path).VersionInfo
"$($_.Name): $($vi.FileVersion)" | Out-File $report -Append
}
}
"`n--- Workshop Content Folder Contents (AppID 431960) ---" | Out-File $report -Append
$workshopPath = "C:\Program Files (x86)\Steam\steamapps\workshop\content\431960"
if (Test-Path $workshopPath) {
Get-ChildItem -Path $workshopPath -Recurse -File |
Select-Object FullName, LastWriteTime, Length | Out-File $report -Append
} else {
"Workshop content path not found (Wallpaper Engine may not be installed)" | Out-File $report -Append
}
"`n--- Recent Firewall Rules ---" | Out-File $report -Append
Get-NetFirewallRule | Where-Object { $_.DisplayName -like "*Block*" } |
Select-Object DisplayName, Enabled, Direction, Action | Out-File $report -Append
Write-Host "Scan complete. Report saved to $report"
Invoke-Item $reportSave this as wallpaper-engine-security-check.ps1, right-click and choose “Run with PowerShell” as Administrator, and review the generated report. Combine it with the scheduled task from Step 11 to run this automatically every week, giving you a running history to compare against if something looks different later.
How This Compares to Broader Gaming Platform Security Practices
The Wallpaper Engine and Steam Workshop threats covered here fit a broader pattern across gaming platforms in 2026: attackers increasingly favor supply-chain-style abuse of trusted distribution channels over direct exploitation. The same logic applies to Discord (bots and “verified” server invites), Roblox (exploit scripts marketed as cheat tools), and even game launchers themselves. If you’ve dealt with a Roblox-specific infection before, the cleanup principles in our Roblox exploit malware removal guide follow nearly the same process: identify persistence, verify through offline scanning, then rotate credentials from a clean device.
The account-hijacking angle also overlaps heavily with session token theft more broadly. If any step above turned up evidence of an active session being used without your knowledge, whether on Steam, Discord, or elsewhere, our dedicated session hijacking detection and response guide covers the deeper incident-response steps beyond what a single-platform cleanup addresses, including how to check whether a hijacked session was used to pivot into other linked accounts.
| Threat | Primary Vector | First Documented / Disclosed | Key Defense |
|---|---|---|---|
| Wallpaper Engine / Workshop DarkKomet campaign | Infected application wallpapers via Steam Workshop | Mid-2026 (Kaspersky report) | Remove app-wallpaper Workshop subscriptions, update to current client |
| AggregatorHost.dll infostealer | Malicious DLL sideloaded via Workshop content | 2026 (Hive Pro advisory) | Process Explorer DLL audit, offline AV scan |
| Malicious Steam game listings | Direct storefront game installers | March 2026 (FBI notice) | Verify publisher reputation, avoid unreviewed new releases |
| FACEIT verification phishing | Lookalike domains harvesting Steam credentials | June 2026 (Malwarebytes) | Manually type known domains, never click DM verification links |
| VVS Stealer | Discord token theft via LevelDB extraction | Since April 2025, active through Oct 2026 | Authenticator-app 2FA, revoke unused authorized apps |
| XIGNCODE3 kernel driver flaws | Local privilege escalation via anti-cheat driver | 2026 (independent researcher disclosure) | Verify game files, keep anti-cheat driver current |
Frequently Asked Questions
Is Wallpaper Engine itself safe to use in 2026?
Yes, the core application is legitimate and widely used. The risk came specifically from the “application wallpaper” feature that allowed executable content to be uploaded through Workshop, a feature the developers removed after the malware campaigns came to light. Sticking to standard video and scene wallpapers, and keeping the client updated, avoids the vector entirely.
How do I know if a Workshop item is safe before subscribing?
Check subscriber count, read recent comments for reports of odd behavior, and avoid items linked directly from Discord or forum posts rather than found through in-app search or curated collections. A new upload with few subscribers and a generic description warrants extra caution.
Do I need to reinstall Windows after this kind of infection?
Usually not. The malware families documented in these 2026 campaigns are userland stealers and backdoors, not disk-level rootkits or bootkits. A full offline scan combined with the Workshop content removal and credential rotation in this guide addresses the threat for the vast majority of cases. A full reinstall is only necessary if you find evidence of deeper persistence (a modified bootloader or firmware-level implant), which is rare for this threat class.
Can antivirus alone have prevented this?
Not reliably. Several of the campaigns described here used techniques specifically designed to delay signature-based detection, including DLL sideloading into legitimate processes and time-limited malware builds. Antivirus is a necessary layer, not a complete solution, which is why this guide also covers manual process and persistence auditing.
What should I do if I already traded away items before noticing the compromise?
Contact Steam Support through help.steampowered.com immediately with your trade history and any evidence of the compromise (login history, malware scan results). Steam does review and sometimes reverses fraudulent trades, particularly when reported quickly and supported by clear evidence, though outcomes vary by case.
Is the XIGNCODE3 driver vulnerability something I can fix myself?
Not directly. Since it’s a kernel driver shipped by the anti-cheat vendor and bundled with specific games, the fix has to come as an updated driver from the game or anti-cheat publisher. Your role is verifying you’re on a patched version (Step 10) and keeping the game updated, not patching the driver yourself.
Does this affect Mac or Linux gaming setups too?
The specific campaigns detailed here (Wallpaper Engine, AggregatorHost.dll, XIGNCODE3) are Windows-specific, since Wallpaper Engine and most anti-cheat kernel drivers only run natively on Windows. Discord token theft and Steam credential phishing, however, are platform-agnostic and apply equally to Mac, Linux, and Steam Deck users, so Steps 7 through 9 remain relevant regardless of OS.
How often should I repeat this full check?
Run the full manual walkthrough once now, then rely on the automated weekly Autoruns and hash-baseline comparisons from Steps 11 and the Advanced Tips section for ongoing coverage. A full manual re-check every three to six months, or immediately after any suspicious account activity, is a reasonable cadence for most users.
Related Coverage
- Roblox Exploit Malware Removal: 12 Steps, 90 Min [2026]
- Minecraft Server Security: TCPShield in 12 Steps [2026]
- Secure Windows RDP: Stop Brute-Force in 12 Steps [2026]
- How to Use Shodan for OSINT: Attack Surface Recon in 12 Steps [2026]
- osquery Endpoint Monitoring Setup: 13 Steps, 60 Min [2026]
