Steam is the world’s most popular PC gaming platform. Over the past few weeks, Steam users have been bombarded by a weird malware dubbed “WTF”.
The malware is appropriately named: during the attack, one of your infected friends will send you a message saying “WTF?” followed by a link to a file which appears to be a JPEG.
The convincing message looks like something one of your friends would normally say on Steam. Unfortunately, that JPEG file link is actually a malicious executable. If you click on the link, you’ll end up downloading a .SCR file which is packed with malicious code.

The virus doesn’t even have the common courtesy to give you a funny picture for your troubles. Security blogger Graham Cluley claims that only a small number of antivirus software detect this virus and label it as malware, which means you’re probably not protected against this threat.

An attack from your friends

One of the common traits among Steam viruses over the past few years has been that they’re launched by someone you don’t know. An attacker will add you on Steam and send you a message trying to steal your password, for example. Even those with little understanding of PC security don’t fall for these tricks.

In any case, it’s never a good idea to click on a link shared through Steam. At the very least, send your friend a message asking what the picture is before you click on it: the bot isn’t smart enough to respond to questions. It just repeatedly sends the link to the “JPEG” file.
The only protection you have against this threat is your own common sense. Unless you and your friends have a history of sharing funny pictures and saying “WTF???” a lot, then you should henceforth ignore all WTF messages on Steam.