Steam scam -> fytown

N

Neo_X

Expert Member
Joined
Mar 23, 2005
Messages
1,849
Reaction score
284
Location
Centurion, Pretoria
Ola peoples

just a warning, there seems to be a scammer on the loose on steam

the even scammier portion, seems like he waits tilll you go offline (e.g. go to bed), then messages still online friends, thus easy to wipe out his tracks.
initial message will be something like this (coming from one of your friends, thus you might consider it legit).

DONT LOGIN ON BELOW LINK!!!!!
Can u please vote for my csgo team at fytown
need 2 more votes
team Quartz

Protection

AppUI - Frontend Template & UI Framework
www.fytown.net
Click to expand...
DONT LOGIN ON ABOVE LINK!!!!!

link then takes you through a step to login with steam, and then dies- no voting nada.

If you don't respond to the initial message, he gets quite demanding
Challenge is, the bot/person then deletes the friend relationship after a few days, with all messages (thus you are unable to trace the source), and then starts the scam again from your own account.


Steam does not seem to give an ability to delete a specific website, thus if you go got caught the following is recommended:
  1. Steam: If you want to deauthorize any computer except the one you're logged into, head into Steam > Settings > Manage Steam Guard Account Security and select deauthorize.
  2. Same location -> reset password
  3. Same location -> enable steam guard
  4. then the bugger -> API access. the above does not clear API acesss...bad steam bad.
    1. https://steamcommunity.com/dev/apikey
    2. and remove the API

please share caution with friends (probably not via steam , as i suspect he possibly has an ability to delete chats (not sure on this).
the API portion grants access bypassing 2FA, which can be bad


happy gaming!

*edit*
reddit thread that follows it
https://www.reddit.com/r/csgo/comments/m6xicf

further details of the scam if you want reading (still not clear as to what they do with the accounts, maybe try and sell games?)

www.techpowerup.com

My steam got compromised today

Tonight I received some messages from fellow members and friends from other walks of life about my steam account. Apparently I had been sending messages asking them to click on a link and vote for an e-sports team. At first, I was initially confused about this. I utilize steam guard and 2FA...
www.techpowerup.com
 
Last edited:
I also got that scam message from someone on my friends list lol
 
Neo_X said:
further details of the scam if you want reading (still not clear as to what they do with the accounts, maybe try and sell games?)
Click to expand...
In game items. Some people have some very expensive in game items.
 
I remember getting a similar message from someone on my friendlist a year or 2 ago, I obviously knew better than to click it.

But one of my closer friends sent me a very similar message again a few days ago (I didn't click it again either), and I spoke to him about it afterwards. He said that apparently just by him opening the site, it somehow was able to message all his friends with the same link, he didn't log in or anything.

I don't know how it's able to do this, perhaps it's somehow exploiting Steam API in browser cookies, but this actually seems quite dangerous.

I remember something similar that happened to the YouTuber MarcoStyle, he clicked a link sent to him via an email under the guise of a sponsorship and it scraped all his browser cookies and got access to all his accounts. He has a vid all about it on his channel.
 
DYreX146 said:
But one of my closer friends sent me a very similar message again a few days ago (I didn't click it again either), and I spoke to him about it afterwards. He said that apparently just by him opening the site, it somehow was able to message all his friends with the same link, he didn't log in or anything.

I don't know how it's able to do this, perhaps it's somehow exploiting Steam API in browser cookies, but this actually seems quite dangerous.
Click to expand...

That one is easy his Info is set to public Tell him to change Privacy settings to Friends only at least.

1617614893372.png
 
Got the CS:GO vote thing, Googled it and nothing came up with that URL. Messaged the guy on telegram to inform him he just fell for a phishing scam.

When he logged in all his friends where cleared from his steam account.

Capture.PNG
 
I never log into steam via the web, always only via the program.

If i really need to then i use another browser then nuke the browsing data.

Ive also sent an email to the domain registrar maybe if more people send them an email they will take action.
 
I also fell for it, but I think the problem isn't really with this scammer, he is just a symptom of the bigger problem which lies with Steam.

Let me explain, there is a big network of websites online that make use of the Steam API for various services, some are for trading items, others are handy tools, and then you get these c^%nts that misuse the service to the detriment of everyone else.

I took this whole thing a step further and got in contact with Steam Support (hopefully they take note) of an solution to this whole situation that can ensure this sort of thing is next to impossible to ever happen again.

This is what I propose, please see attached image of a typical 3rd party steam login page, obviously from the URL you can clearly see that it is indeed a valid steam login url, so you aren't logging into some other site with your steam details, you are logging into the official steam and granting access to the 3rd party.

If you look on the right of the page you will see that Steam by no way mentions that is sharing all these capabilities to the 3rd party, you as the user are completely unaware as to the scope of capabilities you are providing to the 3rd party unknowingly.

So I proposed this to Steam Support, implement a permissions based update to their Steam API, such that sites need to request which features/capabilities they require access to, and that will show up as simple check boxes on the login page that are UNTICKED BY DEFAULT with a description of what capability you are allowing them to do on your Steam account, which allows you complete control over what you are actually allowing the 3rd party access to.

It's easy to say never log into a 3rd party site but that's just detrimental to the entire network of sites that use Steam API to the benefit of the user, obviously as things are now the Steam API is completely open to attack from scammers.

Hopefully my message to Steam will get them to take action, opt-in permissions for 3rd party logins are very important to protect the accounts of users on Steam and at the end of the day, to make sure this sort of thing can't happen.
 

Attachments

  • Capture.JPG
    Capture.JPG
    90.8 KB · Views: 13
Don't click any links from Steam messages, even from your friends - they can be hacked as well. It's a big problem and many blogs wrote about it. Also, if you trade using 3rd party marketplaces, make sure it's good. I use DMarket most of the time, for example: https://dmarket.com/csgo-skins/product-card/operation-bravo-case By the way, the link in the first post isn't working for me, so I can't check it.
 
Neo_X said:
Ola peoples

just a warning, there seems to be a scammer on the loose on steam

the even scammier portion, seems like he waits tilll you go offline (e.g. go to bed), then messages still online friends, thus easy to wipe out his tracks.
initial message will be something like this (coming from one of your friends, thus you might consider it legit).

DONT LOGIN ON BELOW LINK!!!!!

DONT LOGIN ON ABOVE LINK!!!!!

link then takes you through a step to login with steam, and then dies- no voting nada.

If you don't respond to the initial message, he gets quite demanding
Challenge is, the bot/person then deletes the friend relationship after a few days, with all messages (thus you are unable to trace the source), and then starts the scam again from your own account.


Steam does not seem to give an ability to delete a specific website, thus if you go got caught the following is recommended:
  1. Steam: If you want to deauthorize any computer except the one you're logged into, head into Steam > Settings > Manage Steam Guard Account Security and select deauthorize.
  2. Same location -> reset password
  3. Same location -> enable steam guard
  4. then the bugger -> API access. the above does not clear API acesss...bad steam bad.
    1. https://steamcommunity.com/dev/apikey
    2. and remove the API

please share caution with friends (probably not via steam , as i suspect he possibly has an ability to delete chats (not sure on this).
the API portion grants access bypassing 2FA, which can be bad


happy gaming!

*edit*
reddit thread that follows it
https://www.reddit.com/r/csgo/comments/m6xicf

further details of the scam if you want reading (still not clear as to what they do with the accounts, maybe try and sell games?)

www.techpowerup.com

My steam got compromised today

Tonight I received some messages from fellow members and friends from other walks of life about my steam account. Apparently I had been sending messages asking them to click on a link and vote for an e-sports team. At first, I was initially confused about this. I utilize steam guard and 2FA...
www.techpowerup.com
Click to expand...
Please Pc-games Gods, please don't let them steal my Steam account!
 
Neo_X said:
Ola peoples

just a warning, there seems to be a scammer on the loose on steam

the even scammier portion, seems like he waits tilll you go offline (e.g. go to bed), then messages still online friends, thus easy to wipe out his tracks.
initial message will be something like this (coming from one of your friends, thus you might consider it legit).

DONT LOGIN ON BELOW LINK!!!!!

DONT LOGIN ON ABOVE LINK!!!!!

link then takes you through a step to login with steam, and then dies- no voting nada.

If you don't respond to the initial message, he gets quite demanding
Challenge is, the bot/person then deletes the friend relationship after a few days, with all messages (thus you are unable to trace the source), and then starts the scam again from your own account.


Steam does not seem to give an ability to delete a specific website, thus if you go got caught the following is recommended:
  1. Steam: If you want to deauthorize any computer except the one you're logged into, head into Steam > Settings > Manage Steam Guard Account Security and select deauthorize.
  2. Same location -> reset password
  3. Same location -> enable steam guard
  4. then the bugger -> API access. the above does not clear API acesss...bad steam bad.
    1. https://steamcommunity.com/dev/apikey
    2. and remove the API

please share caution with friends (probably not via steam , as i suspect he possibly has an ability to delete chats (not sure on this).
the API portion grants access bypassing 2FA, which can be bad


happy gaming!

*edit*
reddit thread that follows it
https://www.reddit.com/r/csgo/comments/m6xicf

further details of the scam if you want reading (still not clear as to what they do with the accounts, maybe try and sell games?)

www.techpowerup.com

My steam got compromised today

Tonight I received some messages from fellow members and friends from other walks of life about my steam account. Apparently I had been sending messages asking them to click on a link and vote for an e-sports team. At first, I was initially confused about this. I utilize steam guard and 2FA...
www.techpowerup.com
Click to expand...
What do the scammers gain from this?
 
Beyond.Celsus said:
Goes without saying
Click to expand...
Quite a few people don't actually know that you can sell skins/cards from your steam inventory.
I sell most of it/all duplicates, think I must have gotten a good few hundred rand over the years.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X