Steam Workshop abused to spread malware via Wallpaper Engine app

Multiple actively exploited vulnerabilities and widespread abuse campaigns were reported: threat actors are using Steam Workshop wallpaper packages to distribute malware and DragonForce ransomware is hiding C2 traffic in Microsoft Teams relays. Researchers disclosed GhostTree, an NTFS recursive-junction evasion technique that can disrupt Defender scans. CISA warned of an actively exploited LiteSpeed cPanel plugin flaw (CVE-2026-54420); Cisco released fixes for an exploited SD‑WAN vManage zero-day (CVE-2026-20262); and critical Fortinet FortiSandbox flaws are being exploited. Additional notable