"The Steam profile image is neither infectious nor executable. It serves as carrier for the actual malware. It needs a second malware to be extracted."
This is extremely relevant.
Agreed. If anything, these images are really a communication channel for when a loader/receiver is already on the client machines. It's where a non-obtrusive infection can be present and at a later date load the true payload.
Exactly. It's clickbait fearmongering. You can use almost anything imaginable as a communication / command & control / subsequent-stage host. Pastebin, tweets, domain names, blockchain transaction data, reddit and HN comments.
The goal is to just put it somewhere online that security software and appliances are unlikely to block or flag as suspicious.
Well, they did a fantastic job on blurring that nickname...