synaptics

Since late 2025, malware has been spreading rapidly through the Steam Workshop, the gaming platform’s built-in service for players to create and share custom content. The attackers are primarily targeting gamers in China and Russia, aiming to hijack their accounts. To pull this off, they are exploiting Wallpaper Engine – a popular live wallpaper app available on Steam – specifically leveraging its Workshop sharing feature. The malware is hidden inside the wallpaper packages users share with one another. Running one of these compromised wallpapers can lead to a stolen Steam account or leave the victim’s system infected with backdoors or crypto miners. What is Wallpaper Engine? Wallpaper Engine is an app that allows you to put animated wallpapers on your desktop. It’s available for both Windows and Android, though our investigation focused strictly on the Windows version. Thanks to a massive Steam community, the app is quite popular, boasting around 100,000 daily active users and nearly a million reviews. It comes with a built-in editor so users can create their own designs, and it supports a few different wallpaper types: Videos: MP4, WebM, and other common video formats Scenes: interactive wallpapers built inside the app’s own editor Web pages: HTML pages powered by JavaScript and CSS, which can also include audio and video elements Applications: active windows from third-party Windows-compatible software that Wallpaper Engine sets as the user’s desktop background That last type, application wallpapers, is where things get risky, because these are essentially standalone programs. They can be anything from mini-games you play right on your desktop, to planners, calendars, system monitors, or widgets tracking your CPU or GPU usage. Application wallpapers: a built-in security risk The whole concept of “application wallpapers” essentially allows foreign code to be run directly on your computer. Cybercriminals took note of this feature and started embedding malware right into these types of wallpapers. Because Wallpaper Engine relies on Steam Workshop for content sharing, anyone can create a wallpaper and publish it for the community to download and install for free. Naturally, this setup is a magnet for bad actors. We discovered dozens of these malicious application wallpapers floating around Steam Workshop, and each one had already been downloaded thousands – or even tens of thousands – of times. When we analyzed them, we caught two different methods the attackers were using to spread their malware: An archive containing the executable wallpaper alongside the malicious files. This payload usually consisted of compromised EXE files, DLLs, or malicious scripts. In other cases, attackers threw a curveball by hiding the malware inside a password-protected archive. Either the victim was tricked into typing the password, or a script handled it automatically. The attackers would hide the password in plain sight – either right in the archive’s name or inside a JSON configuration installed along with other wallpaper files. For all the other variations, the payload triggered automatically when the user selected and applied the wallpaper. Inside an infected game wallpaper On the surface, this wallpaper sample (above) we uncovered in December 2025 looks completely harmless. Once launched, there’s absolutely nothing to trigger your suspicion. The built-in game boots up flawlessly, runs smoothly, and the desktop controls work exactly as they should. But behind the scenes, a full-blown infection is underway. Within just a few minutes, a user might suddenly realize their Steam account has been hijacked, or find their computer crippled by malware, with their files being encrypted by ransomware or their system performance tanking because of a hidden crypto miner. Once the game wallpaper launches, it drops a backdoor file called Synaptics.exe (part of the DarkKomet malware family) straight into the victim’s system. At the same time, an executable named ._cache_GAME1.exe fires up to boot the actual game, NTRaholic. But that ._cache_GAME1.exe module is doing double duty. It simultaneously installs a custom version of a system library called AggregatorHost.dll with a payload inside. This modified library has one main objective: track down the Steam app on the computer and hunt for account credentials. Next, the modified library hijacks the user’s live Steam session. After that, the compromised AggregatorHost.dll sends all the collected data to a server controlled by the hackers at hxxp://120.48.156[.]17/ey.php. Once the attackers have control of that active session, they can use the victim’s account to upload even more malicious wallpapers to Steam Workshop. Attribution and victims The game wallpaper described above is just one flavor of the many variations we uncovered during our research. By weaponizing the application wallpaper feature, bad actors have successfully distributed almost every type of malware under the sun – from popular infostealers and backdoors to crypto miners and botnet loaders. Because the range of tools being used is so diverse, we suspect this isn’t the work of a single mastermind. Instead, it looks like multiple scattered, independent hacking groups are all jumping on the same trend. Right now, the primary targets are gamers in China. The wallpaper art styles and titles are tailored specifically to them, and the data backs it up: our security systems caught a staggering 89% of the malicious download attempts happening right there. That said, there’s absolutely nothing stopping these attackers from pivoting and launching a similar campaign in any other part of the world. Russia comes in second place for total downloads at 5.5%, followed by a smattering of other countries and territories: Singapore (1.4%), Hong Kong (0.9%), Germany (0.9%), Vietnam (0.9%), India (0.5%), and Canada (0.5%). How to stay safe Our investigation proves that even trusted platforms like the Steam Workshop aren’t completely safe from malware. In most cases, we caught old, familiar threats such as DarkKomet, the Lumma and Vidar infostealers, and the RenEngine loader. Kaspersky solutions can easily spot and block all of these payloads, no matter how clever the packaging is, thanks to our proactive security layers. Here are some of the specific threat detection verdicts assigned to the objects we discovered during our research: HEUR:Trojan-PSW.Win32.gen HEUR:Trojan-PSW.Win32.Python.gen HEUR:Backdoor.Win32.DarkKomet Trojan-Dropper.Python.Agent HEUR:Trojan-Ransom.Win32.Gen.gen PDM:Trojan.Win32.Generic. By the time this post went live, the Steam team had already scrubbed the identified malicious wallpapers and links from the platform. However, given how frequently new infected wallpapers keep popping up on the Steam Workshop, you shouldn’t rely on Steam to catch everything. It’s highly recommended to run an antivirus scan on these types of wallpapers before you actually apply them. Indicators of compromise MD5 C2 servers Malicious wallpapers Update, June 17 We have since confirmed that the malicious wallpapers were present in the app as early as August 2025.

Experienced gamers are well aware of the risks of downloading games, mods, skins, and other gaming software from unofficial sources. However, infections can also originate from platforms users typically trust — developer websites and official stores. In this post, we review several cases where attackers distributed malware through official gaming resources. We also explain how to protect your system, loot, and account — so you can keep playing on your favorite platforms without any nasty surprises. Infected Endgame Gear mouse-configuration tool In July 2025, Endgame Gear, a manufacturer of advanced mice aimed at esports players and seasoned gamers, reported a malware infection in its OP1w 4k v2 mouse-config utility. The Trojan remained on the company’s official site for almost two weeks, from June 26 to July 9, 2025. As a result, users who downloaded the utility from the product page during that period also received malware with it. Endgame Gear did not specify what the malicious payload was, but user-scan data suggests it was an XRed backdoor. XRed offers a wide range of capabilities for remote control of infected systems. These include a keylogger and enables attackers to access the command line, browse disks and folders, download and delete files, and take screenshots. XRed can also download additional modules and exfiltrate system data to remote servers. It was gamers themselves who first noticed something was wrong with the OP1w 4k v2 configuration tool. They began discussing suspicious signs on Reddit nearly two weeks before Endgame Gear released an official statement. The key details that raised user suspicions were the size of the program — the infected version was 2.8MB instead of the usual 2.3MB — and the file signature, listed as “Synaptics Pointing Device Driver” instead of “Endgame Gear OP1w 4k v2 Configuration Tool”. In its official statement on the incident, Endgame Gear clarified that users who downloaded the tool from the general downloads page (endgamegear.com/downloads), GitHub, or the company’s Discord channel are safe. The threat only affected gamers who downloaded software directly from the OP1w 4k v2 product page between June 26 and July 9, 2025. After that, the malware was removed from the company’s site. The mouse manufacturer recommends the following steps for any potentially affected users: Delete all contents of the folder C:\ProgramData\Synaptics. Run a full system scan with a reliable antivirus. Download a clean version of the utility. In addition, users should change passwords for all important accounts, including financial services, email, and work-related logins. Malware in three early-access Steam games In 2025, several cases were reported of malware being distributed through early-access games on Steam. In February, this involved PirateFi, a survival sim (we covered this case on the Kaspersky Daily blog). In March, a similar incident occurred with the tactical shooter Sniper: Phantom’s Resolution. In July, attackers uploaded an infected version of Chemia, another survival game. All three cases involved early-access titles — likely because Steam applies looser verification procedures for pre-release games. Let’s take a closer look at these three cases. A few days after the beta release of PirateFi — the first game developed by a studio called Seaworth Interactive — one user reported on a Steam forum that his antivirus had prevented the game from launching. The security software detected the presence of Trojan.Win32.Lazzzy.gen malware, which the game attempted to install in the AppData/Temp directory after launch. The Trojan’s primary goal was to steal browser cookies. These cookies allowed the attackers to access victims’ accounts for financial services, social networks, and other online platforms. Several players who downloaded and ran the game reported that the criminals changed the passwords on their accounts and stole funds. PirateFi was pulled from Steam just four days after release. All users who had downloaded the game — fortunately, only around 800 people — received an official notification from the platform warning them of the malware on their devices. Just a month later, a similar situation occurred with another game — Sniper: Phantom’s Resolution by Sierra Six Studios. Once again, players were the first to suspect something was wrong: they noticed that the game’s description and screenshots were clearly copied from other projects. Another red flag was the developer’s offering a demo installer hosted on an external GitHub repository rather than through Steam. Further examination of the installer’s code by Reddit users revealed suspicious software hidden inside. Like the creators of PirateFi, those behind Sniper: Phantom’s Resolution seemed to be after victims’ online accounts. Following user reports, both GitHub and Steam quickly removed the malicious game from their platforms. The third case, involving a game called Chemia by Aether Forge Studios, was a little different: this time, it was a beta version of a legitimate game that was infected. Cybersecurity researchers believe the attack was carried out by the hacker group EncryptHub, also known as Larva-208. It remains unclear how the attackers managed to inject malware into the game. However, players who launched the Chemia playtest unknowingly downloaded two infostealers to their devices. Both ran silently in the background without affecting gameplay, leaving gamers unaware their systems were compromised. The attackers were targeting data stored in browsers, including saved passwords, autofill info, cookies, and cryptowallet details. At the time of writing, the game is no longer available on Steam. However, neither the platform nor the game’s developer has issued an official statement. Malicious skins on the official Minecraft website Sometimes dangers lurk not just on Steam, but also on developers’ official sites — including the biggest names. In 2018, about fifty thousand Minecraft players fell victim to attackers who uploaded malicious skins to the official Minecraft website. That platform has a fan-interaction system where any player can share skins they create with others — and that’s what the attackers exploited. The malware was spread via PNG skin files, and was capable of deleting programs, formatting hard drives, and destroying backup data. One peculiar detail was that some victims received bizarre messages with titles such as: “You Are Nailed, Buy A New Computer This Is A Piece Of Sh*t”, “You have maxed your internet usage for a lifetime”, “Your a** got glued.” The malicious code’s specifics make experts believe that professional cybercriminals were likely not behind the attack. Still, the Minecraft case clearly demonstrated the vulnerability of content-sharing mechanisms on gaming platforms. How to avoid becoming a victim Installing games, mods, skins, and other gaming software from official sources is, of course, safer than pirating them from shady ones. However, as we’ve shown in this post, even legitimate sites require vigilance. Read reviews carefully before downloading any game or gaming software. Do a quick background check — a simple search might lead you to a Reddit thread discussing suspicious issues. Be cautious with early-access games on Steam. Three malicious games in a single year already signals a trend. Install reliable protection on your device. Many gamers may be skeptical about this last tip, as it’s a common belief in the gaming community that antivirus software slows down games. That may have been true years ago, but tests these days show that the latest security solutions cause no measurable drops in performance. Moreover, Kaspersky Premium even includes a dedicated gaming mode. It turns on automatically when a game launches, postponing database updates, notifications, and routine scans until the session ends — thus minimizing system resource usage. How else do attackers target gamers? Check out our selection of articles on this topic:

Gaming peripherals maker Endgame Gear is warning that malware was hidden in its configuration tool for the OP1w 4k v2 mouse hosted on the official website between June 26 and July 9, 2025. The infected file was hosted on 'endgamegear.com/gaming-mice/op1w-4k-v2,' so users downloading the tool from that page during this period were infected. Endgame Gear is a German PC gaming peripherals firm known for its pro-gaming gear, including the XM and OP1 series mice, which are highly regarded among reviewers and competitive players. Although not as big as brands like Logitech, Razer, and HyperX, it is a respected entity in the space and one of the key emerging firms in the ultra-light gaming mouse segment. Last week, the company announced that its "Endgame_Gear_OP1w_4k_v2_Configuration_Tool_v1_00.exe" tool on its website had been compromised with malware without providing specifics about how the breach took place. "During the period of June 26th to July 9th, a version of the Configuration Tool for the Endgame Gear OP1w 4k v2 wireless mouse, available for download on the OP1w 4k v2 product page, was found to contain malware," reads the announcement. Endgame Gear says the malware has since been removed, and those downloading the tool from its main downloads page at (endgamegear.com/downloads), GitHub, or Discord were not impacted, as those channels delivered a clean version. Reports about malware on OP1's configuration tool surfaced on Reddit nearly two weeks ago, with users highlighting several key differences suggesting that the vendor's site hosted a trojanized installer. Two key differences are an inflated size of 2.8MB (from 2.3MB in the clean version), and "Synaptics Pointing Device Driver" shown in file properties (instead of the legitimate "Endgame Gear OP1w 4k v2 Configuration Tool"). The malware family was identified as the XRed backdoor in user scans, but Endgame Gear stated that it's still analyzing the payload and has not confirmed its type. XRed was previously observed by cybersecurity firm eSentire impersonating a Synaptics Pointing Device Driver in February 2024. The malware was also distributed through trojanized software that shipped with USB-C hubs on Amazon. Endgame Gear recommends that people who downloaded a trojanized version of the installer delete everything from 'C:\ProgramData\Synaptics' and re-download a clean version of the tool from this page. As the malware contains keylogging functionality, the ability to open a remote shell, and data exfiltration, infected users should run a full system scan using an up-to-date antivirus to ensure all malware remnants are removed. Furthermore, passwords should be changed at all sensitive accounts, such as financial institutions, email providers, and work accounts. Going forward, Endgame Gear will discontinue separate download pages and will add SHA hash verification and digital signing for all hosted files to confirm file integrity and publisher authenticity. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report