Kaspersky researchers have uncovered an ongoing malware distribution campaign leveraging Steam Workshop and Wallpaper Engine, a popular Steam application used to create and share animated desktop wallpapers.

Researchers identified multiple infected wallpaper packages which had accumulated thousands of downloads. Steam users in China and Russia were primarily targeted, with other victims located in Singapore, Hong Kong, Germany, Vietnam, India and Canada.

The main goal of the attackers was stealing gaming accounts and deploying additional malware.

Steam Workshop is a built-in feature of the Steam gaming platform that allows users to easily find, install, and manage user-generated content like mods, custom maps, game items, and wallpapers. The Wallpaper Engine app supports several wallpaper formats, including videos, interactive scenes, web pages, and applications.

The application-based wallpaper feature allows executable programs to run directly on a user’s Windows computer, allowing attackers to distribute malicious software under the guise of legitimate content.

Kaspersky identified dozens of infected wallpaper packages available through Steam Workshop. Many of these packages had thousands or even tens of thousands of downloads.

There were two primary delivery methods that attackers used. In some cases, malicious executable files, DLLs, and scripts were bundled directly with the wallpaper package.

In others, attackers hid malware inside password-protected archives, with passwords embedded in archive names or configuration files. Once the wallpaper was installed, malicious payloads executed automatically.

For example, one of the malicious wallpaper samples discovered in December 2025 appeared to function legitimately at first, launching an embedded desktop game without any visible signs of compromise.

In the background, however, the wallpaper deployed the DarkKomet backdoor and installed a modified library designed to target Steam users: it harvested account information and hijacked active Steam sessions.

The attacks were likely conducted by multiple independent threat actors rather than a single group, and were not limited to a single malware family. Across multiple cases, Kaspersky detected malicious wallpapers distributing Lumma and Vidar infostealers and the RenEngine loader. Kaspersky’s security solutions detect and block all malware associated with this campaign.

“Trusted platforms can be abused to distribute malware: the attacks rely on users trusting content hosted within legitimate ecosystems. While many of the malware families involved are well-known, the delivery mechanism enables attackers to reach large numbers of potential victims through seemingly harmless content,” commented Maxim Starodubov, a cybersecurity expert at Kaspersky.

Galaxy Backbone (GBB) has unveiled a new corporate identity, signalling what the organisation described as a new phase of growth and readiness to support the future of digital governance in Nigeria.

The unveiling of the identity was part of activities marking  20 years of providing critical digital infrastructure and services to government institutions.

According to GBB, the rebranding signals the organization’s strategic evolution from a core government ICT infrastructure provider to a broad national digital transformation enabler connecting governments, businesses, and institutions.

Speaking at the 20th anniversary celebration and awards ceremony in Abuja, Senator George Akume, secretary to the Government of the Federation, urges GBB to lead the next phase of Nigeria’s digital transformation.

Represented by Dr Ibrahim Kana, permanent secretary, General Services Office, Akume, described the organisation as a key driver of modern governance, cybersecurity and digital service delivery across Nigeria.

He said Galaxy Backbone has evolved from a modest initiative into the nation’s foremost provider of secure government connectivity, cloud infrastructure, data hosting and shared ICT services, helping to improve efficiency, transparency and collaboration across Ministries, Departments and Agencies.

‘Digital transformation is no longer an option but a necessity. Nations that embrace technology and innovation are better positioned to achieve sustainable economic growth, improve governance outcomes and enhance the quality of life of their citizens,” he said.

Senator Akume stressed that digital transformation is now essential for economic growth and effective governance. He urged Galaxy Backbone to strengthen its role in emerging technologies, including artificial intelligence, cloud computing, blockchain and big data analytics, to support Nigeria’s digital economy and public sector modernisation.

“The next phase of Nigeria’s digital transformation will require greater innovation, stronger cybersecurity capabilities, expanded broadband infrastructure and deeper collaboration among stakeholders,” he added.

Earlier in his remarks, Professor Ibrahim Adeyanju, managing director of Galaxy Backbone, said the organisation’s journey began with a bold vision to connect government institutions and make digital infrastructure a strategic national asset. He noted that two decades later, the organisation has become a critical pillar of Nigeria’s digital ecosystem.

“Twenty years ago, a bold idea was born. An idea that government could be more connected, that technology could transform governance, and that digital infrastructure could become a strategic national asset,” Adeyanju said.

Professor Adeyanju said Galaxy Backbone’s achievements were made possible through the support of the Federal Government, stakeholders, partner agencies and generations of staff who helped build the institution.

He added that the organisation’s greatest strength remains its workforce and reaffirmed its commitment to innovation, service delivery and talent development.

Nigeria Data Protection Commission (NDPC) has said that it plans to seek a review of the Nigeria Data Protection Act (NDPA) 2023 to address emerging technologies such as Artificial Intelligence (AI), robotics and big data, amid growing concerns over privacy, cybersecurity and data governance in an increasingly digital economy.

The proposed review comes as regulators across the world grapple with the rapid adoption of AI-driven technologies and the challenges they pose to existing legal frameworks designed to protect personal data and privacy rights.

Experts believe the move signals Nigeria’s determination to align its data protection regime with global technological developments and emerging regulatory standards.

Speaking during activities marking the third anniversary of the signing of the Nigeria Data Protection Act into law, Dr. Vincent Olatunji, national commissioner and chief executive officer of the NDPC, said the current law requires updates to adequately reflect technological realities that have evolved significantly since its enactment.

According to him, the pace of innovation has made it necessary for policymakers to move beyond broad references to emerging technologies and provide clearer regulatory guidance.

“We are in the era of emerging technologies. At the time the law was drafted, we could only make broad references to emerging technologies, but today we can specifically mention Artificial Intelligence, robotics and big data,” Olatunji said.

The NDPC boss noted that technologies which were once considered futuristic have now become central to economic activities, digital services and public administration.

“Ten years ago, nobody was talking about AI the way we are doing now, but today it has become central to virtually every aspect of digital transformation. We need to be more specific about what constitutes emerging technologies and provide examples because the technologies keep evolving,” he added.

Industry stakeholders say the review is timely, given the increasing deployment of AI tools across sectors including banking, telecommunications, healthcare, education and public services.

They argue that clearer rules are needed to govern automated decision-making, algorithmic accountability, data ownership and cross-border data transfers.

The proposed amendment also aligns with the National Assembly’s ongoing work to assess the existing law and identify areas to strengthen in light of evolving cyber threats and technological advancements.

Senator Afolabi Salisu, chairman, Senate Committee on ICT and Cybersecurity, had earlier indicated that lawmakers were reviewing the legislation to ensure it remains relevant in addressing developments such as AI and emerging cybercrime threats.

Analysts believe the review could further strengthen investor confidence in Nigeria’s digital economy by providing clearer regulatory certainty for businesses operating in data-intensive sectors.

The NDPA 2023 established the NDPC as the country’s primary data protection regulator and created a legal framework for the collection, processing, storage and transfer of personal data.

Since its enactment, the Commission has ramped up enforcement, compliance monitoring, and awareness campaigns to strengthen data governance across public and private institutions.

Olatunji, however, cautioned against excessive reliance on AI technologies, stressing that human oversight remains critical in data processing and decision-making systems.

“We still need the human component. We should not leave everything to artificial intelligence,” he said.

He further noted that issues relating to digital footprints, privacy rights and responsible data use would continue to demand regulatory attention as technology becomes more integrated into everyday life.

Technology policy experts say the emergence of generative AI, machine learning systems and autonomous technologies has created new legal and ethical questions that many existing privacy laws were not originally designed to address.

These include concerns around automated profiling, bias in AI systems, consent management, surveillance and accountability for decisions made by intelligent systems.

Meanwhile, the NDPC has in recent months demonstrated a growing focus on AI governance, including participation in international initiatives aimed at promoting responsible and privacy-conscious deployment of artificial intelligence technologies.

Stakeholders believe that any amendment to the Act should strike a balance between protecting citizens’ privacy rights and supporting innovation within Nigeria’s rapidly expanding digital economy.

Hence, the proposed review signals the likelihood of stricter compliance obligations for business and increased scrutiny of how personal data is collected, processed and utilised.

While experts advise organisations to begin strengthening internal governance frameworks, data management systems and privacy compliance programmes in anticipation of future regulatory changes.

Consequently, the planned review of the Data Protection Act underscores the growing recognition that regulatory frameworks must evolve alongside technological innovation, while for policymakers, the challenge will be ensuring that the law remains flexible enough to encourage innovation while robust enough to protect citizens in an era increasingly defined by data and artificial intelligence.