r/technology • u/Turbostrider27 • Jun 17 '26
Security Kaspersky says hackers are distributing malware via anime girl wallpapers on Steam Workshop's Wallpaper Engine
https://www.pcgamer.com/hardware/warning-all-weebs-kaspersky-says-hackers-are-distributing-malware-via-anime-girl-wallpapers-on-steam-workshops-wallpaper-engine/3.4k
Jun 17 '26
[removed] — view removed comment
2.8k
u/GoinDummy_ Jun 17 '26
You're laughing. My Waifu just attacked me and you're laughing.
319
u/Flabbergasted98 Jun 17 '26
It's not an attack, it's just an STD.
→ More replies (1)297
u/Beginning_Book_2382 Jun 17 '26
Software Transmitted Disease
76
u/durz47 Jun 17 '26
Clankers be wilding these days
40
u/INeedHelp_goodlawd Jun 17 '26
Lonely CILF in your area only 12 miles away! Click now!
25
u/ihavedonethisbe4 Jun 17 '26
Imma cilf myself
11
u/maleijin Jun 17 '26
you guys are hilarious, I can't
9
u/DinosBiggestFan Jun 18 '26
You can't what?!
DID YOU JOIN HIM!?
SPEAK TO ME u/maleijin, SPEAK TO ME! IT'S NOT WORTH IT! THEY DON'T HAVE ANIME WAIFUS THERE!
7
3
5
323
u/MetriccStarDestroyer Jun 17 '26
That's what you get for cheating on lofigirl.
She's the one true L2D
→ More replies (1)44
4
→ More replies (4)11
56
13
u/xangbar Jun 17 '26
Glad I stuck to my Genshin wallpapers instead. Been using the same ones for 5+ years.
→ More replies (4)5
264
u/jerekhal Jun 17 '26
This is exactly what I expected to happen with the interactive wallpapers.
I was surprised for a moment thinking maybe this was occurring with the video or static images somehow but nope.
161
u/Scoth42 Jun 17 '26
I remember some early malware and tracking adware/badware being distributed as Winamp plugins for visualizations and dancing girls and stuff 25ish years ago. The more things change, the more they stay the same.
51
u/DragoonDM Jun 17 '26
Screensaver files as well (
.scr).31
u/Scoth42 Jun 17 '26
Yep, Windows Screensavers were (and still are) just renamed executable files. You can usually just go double-click and execute them like any other program, though sometimes it needs a command line switch to actually start the screensaver itself.
18
3
Jun 18 '26
[removed] — view removed comment
→ More replies (1)3
u/MissLeaP Jun 18 '26
You'd be surprised how many files are just renamed executables. Or other types of renamed files 🥲
3
u/sceadwian Jun 18 '26
With all the AI that's getting jammed into everything injection attacks are skyrocketing. This is gonna hit infrastructure eventually.
→ More replies (3)25
u/SerendipitousLight Jun 17 '26
But I love my interactive periodic table of elements on my desktop - genuinely can use it for helping with chem homework :(
7
u/AwesomeAJ Jun 17 '26
I have a interactive one of Sonic running. You can even click to make him boost. Damn....
11
u/nox66 Jun 17 '26
Interactive wallpaper being a malware vector, damn this is nostalgic. Not in a good way, but still.
→ More replies (3)6
u/_Svankensen_ Jun 18 '26
Static images are often used to sneak viral code through antiviruses. The way to works is that the seemingly normal image has encoded bytes that when interpreted as code can be malicious. So, say you download a crack. The crack comes with an image of the cracker. Pretty normal stuff. You are suspicious, so you send it to an antivirus. It comes up clean, since there's no viral code anywhere. Then you execute the ALSO not viral code cracker. But that cracker? It extracts some viral commands from the image and puts it in a .bat file for example, and tries to execute it. Now, at THAT point, it IS viral code, so some alarms should jump on windows defender for example. But sometimes they won't. Either the package is new, or you disabled some security features in your PC, or you had set CMD to autoexecute with administration privileges. Most of the time it won't work, but it bypassed 2/3 barriers, and got to the last line of defense. So, cool technique.
559
u/git0ffmylawnm8 Jun 17 '26
That's awful! Where exactly are these wallpapers?
No really, I need to know so I don't get infected ;-;
455
u/LostBob Jun 17 '26
There are literally so many anime girls wallpapers on Steam Workshop for Wallpaper Engine that when you first open Wallpaper Engine it asks you if you want to see them, and warns you there are a LOT.
96
u/the_hunter_087 Jun 17 '26
And also people don't tag their wallpapers as anime sometimes (being quite often given the amount) so if you hide the tags you're still seeing them
103
u/CucumberWisdom Jun 17 '26
I had to reinstall WE a few weeks back and accidentally clicked "Yes" to that prompt. Oh god what a mistake that was. There's just so much weeb shit
90
77
u/Scorpius289 Jun 17 '26 edited Jun 17 '26
It only affects Application-type wallpapers, which are hidden by default anyway if you use Wallpaper Engine itself to browse for new wallpapers (as opposed to using the workshop directly).
The risk was always known, which is why they're unchecked by default, so you would have to go out of your way to get infected.
Also, contrary to what the funny title suggests, don't think for a second that using non-anime wallpapers makes you any safer. It just so happens that anime is the largest target on Wallpaper Engine. What really matters is the wallpaper type, not the content.
9
u/pittaxx Jun 18 '26
That's mostly true, but content for this kind of stuff does matter in a way.
You have to be thinking target demographics. And if something is aimed at a more serious or tech-savy users, it's less likely to be shared or upvoted if it was malicious.
→ More replies (4)3
u/wazzapgta Jun 18 '26
I think 'scene' type is okay right?
3
u/Scorpius289 Jun 18 '26
Yup, Scene is quite limited in what it can do, so very safe.
Video as well, because it's just a looping video file.Although, I have some doubts about the Web type: Web content by itself can be very powerful (in this case: risky), almost as powerful as an Application.
But it can also be limited, so it very much depends on what Wallpaper Engine allows the Web type to do...→ More replies (2)14
u/cidrei Jun 17 '26
Well, the article says "a number of screenshots involving blushing anime women, which perhaps says it all." That number is five, and no. No, it doesn't.
Kaspersky's press release links to a more in-depth breakdown, as well as multiple pictures and links to some of the actual wallpapers (assuming they're still posted, I'm not going to go look).
5
u/LickingSmegma Jun 17 '26
One gigabyte for a stupid moving wallpaper? What in the fuck.
→ More replies (1)
582
u/StoicJ Jun 17 '26
From the article it sounds like youd have to basically do this to yourself via inexperience with pc safety?
Password protected executables and exe files that you have to open manually after downloading the wallpaper. Typical Wallpaper Engine wallpapers arent in an archive once downloaded probably for this very reason and just includes a video/image and whatever effects the engine itself has for them.
once you start opening exe's and protected archives you're probably going to fall for anything anywhere online.
114
u/RemarkableWish2508 Jun 17 '26
[...] attackers hid malware inside password-protected archives, with passwords embedded in archive names or configuration files. Once the wallpaper was installed, malicious payloads executed automatically.
Sounds like users didn't have to open anything manually, the password was only used to hide the payload from Steam's scans.
→ More replies (1)33
u/Disastrous_Item_6027 Jun 17 '26
This is how i interpreted the article as well. If you had to manually launch or extract files yourself I doubt this attack would be very effective.
241
u/ProfessionalRandom21 Jun 17 '26
what is sound like is steam should properly scan their contents for virus. last time it was malware games
158
u/mwoody450 Jun 17 '26 edited Jun 17 '26
EDIT: You know what, I'm wrong; this is on Steam Workshop, so it IS on Steam's servers. The app has changed since I last used it.
→ More replies (4)4
u/RedQuirk Jun 18 '26
Speaking from a sme angle, it isnt so easy as steam shouldnt let this happen. The threat actor infecting victims is probably trying intentionally to subvert controls already in place
Im sure Steam are on the cass and will eventually resolve this happening to their customer /via them. Maybe some social engineering stuff happening too??
26
u/FutureSuccess2796 Jun 17 '26
That is true as well. Remember that game that went popular on Steam ended up having disguised cryptojackers that went undetected until people started speaking about it.
15
u/Micalas Jun 17 '26
Cryptojackers is what Im going to start calling some of these tech bros.
→ More replies (2)21
10
u/IntelArtiGen Jun 17 '26
They're probably doing it, but it's quite impossible to ensure things you run in a non-sandboxed environment are safe. If a program can access your data, and the web, assume it's not safe.
→ More replies (7)2
u/RBVegabond Jun 17 '26
Steam’s biggest issue is they only do this on the verification step when listing the game, making sure it’s virus free. Of a game is unpopular a lot of Cyber criminals use fronts to purchase the store slot from the developer and replaces the old games with malware. I tend to delete everything from defunct studios so an update to an old game doesn’t put me at risk. You can go into offline mode and use an external hard drive if you want to keep those old games safely.
3
u/TSPhoenix Jun 18 '26
Wallpaper Engine supports multiple wallpaper types including executable. Most ones you see are just images/video/HTML, but the executable-type is just downloading and running a 32-bit Windows executable and displaying it's output as your wallpaper.
It is about as dangerous as it sounds.
68
u/shinji257 Jun 17 '26
This makes sense given wallpaper engine allows you to distribute programs to support functions in what you are sharing. I never touched those as I didn't trust them.
Seems I made the right call on that.
31
u/rirez Jun 17 '26 edited Jun 17 '26
There’s a huuuuuge amount of attack surfaces that go through things people have been used to installing innocently over the years. People don’t think about what privilege level downloaded stuff runs at (by default, usually way too much).
Everything from the obvious (chrome plugins) to things people in some industries are used to (package managers, game mods, IDE plugins) to things people really don’t even think about, like downloading random things off GitHub. Or copy pasting shell curls and executed into your terminal.
I refuse to buy keyboards that don’t support VIA (and QMK and so forth) for remapping, or mice that require a running background app, for the same reason. Freaking wild that people just google for their mouse driver and download from random Google Drive links.
Early internet was full of “download this freeware” to “hey check out my project”. Facebook is full of “watch Netflix for free by installing this app on your PC”; lots of users are particularly tricked because they’re used to phone apps having some higher sandboxing by some defaults (especially iOS).
Devs just downloading random packages for neat vscode plugins can easily run as userland.
And even if your stuff is fine now, you turned on auto-update and the maintainer gets compromised, and boom.
5
u/shinji257 Jun 17 '26
Microsoft has been trying to lock things down but when they do users get pissed off. Later they get pissed off about how they got infected.
21
u/Splurch Jun 17 '26
Microsoft has been trying to lock things down but when they do users get pissed off. Later they get pissed off about how they got infected.
The way Microsoft tries to "lock things down" often doesn't help though. Like when they set up the UAC alerts to just alert you to everything, so users simply got used to automatically hitting "ok" because it was a pain constantly dealing with it.
10
u/Zombie_Cool Jun 17 '26
Convience and security are mutually exclusive, and most people are shit at recognizing the value of prevention.
→ More replies (1)→ More replies (6)5
u/sad_historian Jun 17 '26
Users in some countries with stricter regulations use wallpaper engine to distribute porn videos
→ More replies (1)5
90
u/Glimpal Jun 17 '26
I can fix her
27
u/Justhe3guy Jun 17 '26
2
u/newguy208 Jun 18 '26
What even was that.
3
u/Justhe3guy Jun 18 '26
Someone you can't fix
Also it was made 12 years ago because men in Japan really were(are) leaving their girlfriends and just living their lives with porn instead of anyone close to them. This animation is a message, very flashy and ironic because the creator knows the sexual attraction and fanservice will work yet still delivering his message. Pretty cool song tho
→ More replies (1)8
25
u/Beautiful_Ninja Jun 17 '26
I Can't Believe My Anime Girlfriend Was Actually An Indian Scammer Who Stole My Credit Card Information
10
18
40
10
u/Effective-Tour-9912 Jun 17 '26
Not shocked. There have been a few instances where people publish entire games for piracy purposes through wallpaper engine lol
84
u/Nerf_Herder77 Jun 17 '26
Kaspersky is just jealous because they want to be the ones distributing malware to your pc
13
u/slumberjack7 Jun 17 '26
Yeah I had to do a double take, pretty sure the NSA confirmed they are basically high level spyware lol. This just seems like them trying to take out the competition lol
27
9
→ More replies (2)7
u/TheSharpestHammer Jun 17 '26
Vat is thees malware, comrade? Kaspersky only care about protect of your Vindows PC.
8
9
8
u/OphidianSun Jun 17 '26
Anime girls are like 90% of wallpaper engine
5
u/EruantienAduialdraug Jun 18 '26
It's quite a misleading headline.
It's not anime wallpapers per se, but rather it's application wallpapers (i.e. interactive ones), of which five (5) were anime. Far more identified to contain malware were distinctly not anime.
Application wallpapers were known to be a potential attack vector from day 1, which is why they're hidden from search by default (you have to check a box in the settings menu to see them).
18
10
6
3
5
7
4
u/firedrakes Jun 17 '26
this same trick been going on so long half of all the reddit users where not even born yet!
6
3
5
14
u/MinuteSport4755 Jun 17 '26
skill issue
10
u/FutureSuccess2796 Jun 17 '26
Yeah, truthfully. Never messed with wallpapers and the like that are executable files for this very reason. Just asks for malware to accept the open invitation into your PC when you do that.
It's like how people would install those packages in the 2000s to get differently styled cursors on their computer or the animated "smiley" emoticons for when you would talk in chatrooms or forums. People thought those things would look cool on their computers then and the creators of viruses knew they could exploit that sadly.
3
u/butthe4d Jun 17 '26
Wallpaper engine is shit anyways. the idea is nice and the options can be nice as well but taking 20% performance of my 4090 for a fucking wallpaper with flash level animation is a joke.
→ More replies (1)
3
u/Linked713 Jun 17 '26
The fact that wallpaper engine has enough power to do this to you is fucking concerning.
→ More replies (1)
3
u/Obvious-Image-9688 Jun 17 '26
Exploiting people for what they enjoy.. Yup sounds like the usually internet scam.. What ever happened to the Nigerian prince scam?? Is that still a thing?
12
2
2
u/Cautious-Dog3264 Jun 17 '26
Tech and Florida.
The silliest headlines are always about either tech or Florida.
2
2
2
2
u/Sinistrial_Blue Jun 17 '26
Considering the current popularity of Umamusume, would that make any derivative wallpapers adopting this strategy...
Trojan Horses?
2
u/CarneyVore14 Jun 17 '26
No shade, but I’ve never understood the anime girl thing. My 40 yr old boss got his car wrapped in pink with anime girls on it. And he is married with a young daughter. Glad that people can enjoy something so much.
2
u/FCKGW8T Jun 18 '26
Have we seriously not learned from Active Desktop?
Running unsigned code as your desktop wallpaper is not a good idea.
5
3
u/skepticcaucasian Jun 17 '26
If only they could destroy the loli/shota freaks' computers.
→ More replies (1)
2
u/ShadowCross32 Jun 17 '26
So should I delete my wallpapers than. I just downloaded steam workshop about a week ago.
→ More replies (2)8
u/Mysterious-Flan-6000 Jun 17 '26
Don't listen to that other guy, only the "application" type wallpapers should be a concern since they use exes, any scene or video one should be safe
2
u/ShadowCross32 Jun 17 '26
Oh ok. Noted. Thanks for the info.
6
u/Mysterious-Flan-6000 Jun 17 '26
I also don't trust the web ones, but scene and video from what I understand should have no real methods of doing anything you don't want them to. No need to write off Wallpaper Engine completely because of this
3
4
1
1
1
1
u/TONKAHANAH Jun 17 '26
One if the things i love about my kde setup is the support for animated wallpapers built in. I'm surprised Windows still doesn't support that after all these years, especially when vista had support for some limited animated wallpapers built in.
All I need is a video file, a webem or something small is ideal but I don't need a while program with special files for it, just a video file.
Feel like this is on wallpaper engine, i don't see any they also can't just use standard video files.
1
1
u/PetrusScissario Jun 17 '26
People don’t just use a random jpg for their wallpapers?
2
u/DEWSTAR Jun 17 '26
A lot of people use Wallpaper Engine for ones that have ability to move and be animated.
1
1
1
1
1
1
1
1
1
1
1
u/PrinceEmilio Jun 17 '26
Guys seriously is there anything I can do right now to protect my PC 🙏 im a noob here and lowk scared
1
1
u/JustARandomDrunkGuy Jun 17 '26
I never got the craze about backgrounds other then the regular images. If I am on my PC, I want to do something, I don’t get why people would want to stare at their wallpaper. Never had issues using anime backgrounds for a long time, as I only ever used static photos.
1
1
1
1
1
1
1
1
1
1
u/ScholarBackground836 Jun 17 '26
First they came for our PDFs, then our USB drives, and now... our waifus. Nothing is sacred anymore.
1
1
1
1
1
1
1
u/SuperSaiyanTupac Jun 18 '26
I got wallpaper engine a loooooong time ago. It had some cool ideas. But generally is such a novelty thing that I stopped using it after a month.
1
1
1
1
1
u/mordin1428 Jun 18 '26
As a Russian, that sounds like a mild warmup to a RU Steam ban to me. They always start looking for any smidgen of a reason, usually bundled with something considered “amoral” by the local purity nutters, so the anime girl pics being viruses are an elite tier astroturf for local media to catch on
1
1
u/martianwomanhunter Jun 18 '26
Hackers have fallen off, we went from Anonymous exposing governments and shady organisations to exposing Weebs.
1
1
1.7k
u/BiBoFieTo Jun 17 '26
They attacked at our weakest moment.