Steam Workshop malware made headlines recently when attackers were caught hiding malicious code inside user-created content for the popular Wallpaper Engine app. If your first reaction is 'that's a gaming thing, not a business problem,' read on — because the method these attackers used is exactly the kind of threat that quietly drains credentials from employee machines and ends up on dark web markets before anyone notices.
What Actually Happened With Steam Workshop
Wallpaper Engine is a legitimate and widely used application that lets people set animated or interactive wallpapers on their Windows desktops. It pulls community-created content through Steam Workshop, a platform normally associated with video game mods. Attackers discovered they could embed malicious scripts inside Workshop submissions. When an unsuspecting user downloaded and applied one of these wallpapers, the hidden code executed in the background.
The payload in cases like this is almost always an infostealer — a type of malware designed to silently harvest saved passwords, browser cookies, session tokens, and cryptocurrency wallets from the infected machine. The stolen data is packaged and sent back to the attacker, then typically sold on dark web markets or used directly to access corporate accounts.
Why This Is a Real Business Risk, Not Just a Personal One
Here is where SMB owners and IT managers need to pay attention. Employees use their work machines for personal tasks all the time. A wallpaper app installed on a work laptop, or even a home computer used for remote work, is a credible attack surface. Infostealers do not distinguish between a personal Netflix password and a saved VPN credential or a browser-stored login to your company's accounting software.
Once an infostealer has done its job, the damage is invisible to the victim. There is no ransomware popup, no system crash, no obvious sign that anything went wrong. The credentials simply appear in a data dump, get listed on a forum like Russian Market or 2easy, and sit there waiting for someone to use them. By the time a business realises its systems have been accessed by an unauthorised party, weeks or months may have passed.
This is precisely the window that causes the most damage. Attackers use stolen session cookies to bypass multi-factor authentication entirely, meaning even businesses with MFA enabled are not automatically protected once a cookie has been lifted from a browser.
How Infostealer Logs Reach the Dark Web
After an infostealer runs on a machine, the collected data is compressed into what the cybercrime community calls a log. These logs are sold in bulk on dark web marketplaces and Telegram channels. A single log can contain hundreds of credentials from one device — email accounts, CRM logins, cloud storage, banking portals, and internal tools.
Breachrr monitors these infostealer log markets, along with breach databases, public code repositories, and domain infrastructure, to detect when business credentials show up somewhere they should not be. The challenge for most SMBs is that they have no visibility into this layer of the internet. They find out about a compromised account when something breaks, not before.
Steam Workshop is just one of many unconventional vectors attackers are now exploiting. We have seen similar techniques used through browser extensions, pirated productivity software, and even fake font packages. The common thread is always the same: a seemingly harmless file executes quietly, and the data leaves the machine without a trace.
What You Can Do Right Now
Start by having a conversation with your team about what software is installed on work devices, particularly anything sourced from community platforms or third-party download sites. A formal acceptable use policy for work machines is worth the hour it takes to write.
More importantly, check whether your business credentials are already circulating. By the time Steam Workshop malware makes the news, the credentials stolen through earlier campaigns are already out there. Many SMBs are exposed and simply do not know it yet.
Breachrr scans breach databases, infostealer dumps, dark web markets, and public repositories to give you a clear picture of your exposure. If employee or company credentials have been compromised, you will see exactly where they appeared and what action to take. Run a free audit at breachrr.com/audit and find out where your business actually stands before an attacker does.
Want to see if your company is exposed?