THU 02 JUL 2026 · GMT EDITION A WHITESTONE INTELLIGENCE PUBLICATION
MARKETS · CYBER · MEMOS · MODELS
DAILY ISSUES26 MAY27 MAY28 MAY29 MAY30 MAY31 MAY01 JUN02 JUN03 JUN04 JUN05 JUN06 JUN07 JUN08 JUN09 JUN10 JUN11 JUN12 JUN13 JUN14 JUN15 JUN16 JUN17 JUN18 JUN19 JUN21 JUN22 JUN23 JUN24 JUN25 JUN26 JUN27 JUN28 JUN29 JUN30 JUN01 JUN02 JUNALL ›
FRONT PAGE / CYBER / CYB-2026-06-16-F2
CYBER · ransomware threat groups · 2026-06-16SCOOP 55

Dozens of Malicious Wallpapers Found on Steam Workshop, Gamers' Accounts at Risk

Kaspersky's Securelist reported on June 16 that malware has been spreading rapidly through Steam Workshop, the platform's built-in service for sharing custom player content, since late 2025.

·FILED ISSUE 2026-06-16·1 MIN READ·RE-VERIFIED 2026-07-02 UTC·✓ RE-VERIFIED 2026-07-02

At a glance

  • Kaspersky found dozens of malicious wallpapers distributing malware via Steam Workshop.
  • The campaign has been active since late 2025 and primarily targets gamers in China and Russia.

VERDICT — CONFIRMED

pipeline-backfill confidence · primary + corroborating sources verified · re-verified 2026-07-02 UTC
Cyber desk illustration
Generated desk illustration · The Dossier Wire · not a photograph

Malware has been spreading rapidly through Steam Workshop, the platform's built-in service for sharing custom player content, since late 2025, Kaspersky's Securelist reported June 16.

Dozens of malicious wallpapers were found on the service, per the report, putting gamers' accounts at risk, and the attackers behind the campaign are primarily targeting users in China and Russia, per Kaspersky's assessment.

Not specified in the available summary: the malware families involved, infection counts, the mechanism by which wallpaper content delivers malicious code, and any response from Valve, which operates the Steam platform. The findings, the late-2025 start date and the China-Russia targeting assessment are attributed to Kaspersky's researchers; the full Securelist post was not reviewed, and independent confirmation was not available in the material reviewed.

Key facts on file

  • Kaspersky found dozens of malicious wallpapers distributing malware via Steam Workshop.
  • The campaign has been active since late 2025 and primarily targets gamers in China and Russia.

PRIMARY SOURCE

Securelist (Kaspersky GReAT)
— (2026-06-16) · fetched at filing · archived at publication
Filed underMALWARE

Sources · two-source rule

PRIMARYSecurelist (Kaspersky GReAT)— (2026-06-16)
Share
Filed by the Cyber desk · verified by the verification desk · re-verified 2026-07-02 · Our standards: the two-source rule ›
CITE THIS FILE — The Dossier Wire · cyb-2026-06-16-f2 · filed 2026-06-16 · https://thedwire.com/wire/cyb-2026-06-16-f2-dozens-of-malicious-wallpapers-found-on-steam-workshop.html · Primary and corroborating sources listed above; archived at publication. Republishing & licensing: hello@thedwire.com.
More from Cyber FULL DESK ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 79

CISA Adds Two Known Exploited Vulnerabilities to Catalog: Cisco Catalyst SD-WAN Manager and LiteSpeed cPanel Plugin

CISA added two actively exploited flaws to its KEV catalog on June 15: CVE-2026-20262, a directory/path traversal vulnerability in Cisco Catalyst SD-WAN Manager, and CVE-2026-54420, a UNIX symbolic link following vulnerability in the LiteSpeed cPanel plugin. Per the alert, both were added based on evidence of active exploitation, and BOD

✓ verifiednewSOURCE ↗
READ THE FILE ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 57

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

Cisco's June 15 PSIRT advisory describes an arbitrary file write flaw in the web UI of Catalyst SD-WAN Manager (formerly SD-WAN vManage) that lets an authenticated remote attacker create or overwrite any file on the underlying operating system. The bug stems from improper validation of user-supplied input during a file upload process and

✓ verifiednewSOURCE ↗
READ THE FILE ›

The morning wire in your inbox — every brief, primary sources linked, no noise.

Free tier. The Wire — continuous desk briefs · Records archive · Bureau alerts.

Stored to the wire's subscriber list. No spam, unsubscribe any time.