Cluley posted a screenshot of a chatbox that showed messages coming in that say “WTF?????” followed by a link to what appears to be an image. Clicking on the link results a malicious screensaver, or .SCR, file being downloaded.
Seeing the message likely indicates that a contact on the Steam friends list has had their system infected with the malware, Cluley said, adding the threat possibly puts Steam account credentials at risk of being stolen.
Popular chat services have long been a target of this activity. In his report, Cluley linked to a September Malwarebytes post discussing a similar threat. Also in September, F-Secure identified malware being served over the chat feature for video game streaming service Twitch.