Hacked after 20 minutes of gameplay.

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

I've been on steam for over ten years, never has this happened and backtracking has connected PUBG to what happened.
11 September I finish downloading the game and hop on at 11:28.
I play for a while, close the game.
The following evening someone accesses my steam account which is protected by 2F and steam mobile.

All my inventory items were sold, games in my inventory were gifted to various accounts. The money made selling my items were used to buy DOTA2 items.
This all happened in tandem with closing PUBG leading me to believe this game is compromised.
I repeat, I have over ten years on steam with over hundreds of games played, this all happened the moment I launched PUBG


BEWARE

And note: Items that were bought are 0.03$ items bought at over 1$. Leading me to believe that whoever accessed my account bought his own market items. The accounts associated with the gifts sent were random letters and numbers with on steam profiles.

[Lega]

You are the first person after many years who said his account got hacked through PUBG.

It's very unlikely PUBG has a role there Garys mod would match better because it has private servers the owners may get your IP from.

Even this is highly speculated but if your account was protected by 2FA it seems like you got phished on third party websites.

Some websites try to make them look legit and offer services where people need to login with their data from Steam including 2FA.

Even Steam and one unknown exploit is more plausible than PUBG.

Btw, if he sold something on the market, he never remove the authenticator but this is necessary if someone steals your account externally.

Your PC may be infected by spyware.

[jackdoslanti]

Got to agree with Lega here. I would look at what actions you have been doing yourself here and check your own security on your PC but mainly on your phone. 2FA isn't that easy to break, it is easy however to social engineer it so you give your details away.

Have you linked your steam account with any third parties? Skin sellers etc?

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Strange ♥♥♥♥, whatevers the case. None of my machines have been compromised for ten years and now suddenly some chinese has access to my inventory, sold 58 items in total and bought dota 2 items for incredible markups. What the ♥♥♥♥. But I guess can't blame PUBG, it just linked in too well looking at all the timestamps. Exactly when I launched PUBG to playing the first match and suddenly im compromised.

[jackdoslanti]

What's the account that has sold your items? Can't you report this up?

[jackdoslanti]

Originally posted by fyserium:

Strange ♥♥♥♥, whatevers the case. None of my machines have been compromised for ten years and now suddenly some chinese has access to my inventory, sold 58 items in total and bought dota 2 items for incredible markups. What the ♥♥♥♥. But I guess can't blame PUBG, it just linked in too well looking at all the timestamps. Exactly when I launched PUBG to playing the first match and suddenly im compromised.

Doesn't work like that. PUBG and the pubg software on your PC doesn't relay your 2FA Steam details.

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Originally posted by jackdoslanti:

What's the account that has sold your items? Can't you report this up?

11 Sep, 2024
2:59pm
Gift sent to and redeemed by ykxm9tay

11 Sep, 2024
3:01pm
Gift sent to and redeemed by 0gn4i1xf

To reply to your other answer too, I havent even got a message from steam to confirm on mobile for any sales or access to my account. Extremely odd thing that has happened.

[jackdoslanti]

Yeah, looks like those profiles have been and gone - don't exist now. Contact steam, report it up. Change all your passwords and reset your 2FA on your mobile. Scan your mobile and remove any unwanted apps....

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Originally posted by jackdoslanti:

Yeah, looks like those profiles have been and gone - don't exist now. Contact steam, report it up. Change all your passwords and reset your 2FA on your mobile. Scan your mobile and remove any unwanted apps....

Crazy, i've never seen or heard of a similar case. I for the life of me can't access my steam without my phone, how someone else did is just baffling. And all that for no profit.

[Hello]

Originally posted by fyserium:

Originally posted by jackdoslanti:

Yeah, looks like those profiles have been and gone - don't exist now. Contact steam, report it up. Change all your passwords and reset your 2FA on your mobile. Scan your mobile and remove any unwanted apps....

Crazy, i've never seen or heard of a similar case. I for the life of me can't access my steam without my phone, how someone else did is just baffling. And all that for no profit.

no one hacked your account, because you 100% gave away your steam login details.
where? you might already know by now who you gave them away.

DO NOT TRADE

1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a trusted/clean computer.
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

Good Luck

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Originally posted by Hello:

Originally posted by fyserium:

Crazy, i've never seen or heard of a similar case. I for the life of me can't access my steam without my phone, how someone else did is just baffling. And all that for no profit.

no one hacked your account, because you 100% gave away your steam login details.
where? you might already know by now who you gave them away.

DO NOT TRADE

1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a trusted/clean computer.
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

Good Luck :blessyou:

I've done all five steps earlier today and feel rather secure.
Backtracking even further I did log into steam through a CSGO Skin buying, selling and betting platform that allows you to log in through their website to purchase and sell skins. Only plausible answer. Whats the next step? Finding out who owns the website and put a bitcoin on his head? Accept it and move on.

[Crunchy[Daz]]

So which is it? It happened as soon as you closed PUBG or it happened the night after? It can't be both.

This stuff happens alot. You know how many emails people get saying someone tried to log in from the other side of the world? Your data is out there bud. Your emails, some of your passwords, alot of info. Sometimes someone pieces enough together to gain access.

No one playing PUBG is going to get access to your Steam account or it wouldn't be on the platform. You further go on to say that you put your Steam credentials into a shady third party CSGO website.... hmm...... I wonder where the issue is. I wonder what could have possibly been the problem?

Is it hackers in PUBG gaining your info from playing a match with you or is it you literally giving away your login information to a website. C'mon man....

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Originally posted by CrunchyDaz:

So which is it? It happened as soon as you closed PUBG or it happened the night after? It can't be both.

This stuff happens alot. You know how many emails people get saying someone tried to log in from the other side of the world? Your data is out there bud. Your emails, some of your passwords, alot of info. Sometimes someone pieces enough together to gain access.

No one playing PUBG is going to get access to your Steam account or it wouldn't be on the platform. You further go on to say that you put your Steam credentials into a shady third party CSGO website.... hmm...... I wonder where the issue is. I wonder what could have possibly been the problem?

Is it hackers in PUBG gaining your info from playing a match with you or is it you literally giving away your login information to a website. C'mon man....

11 Sep, 2024
2:19am
Earned in PUBG: BATTLEGROUNDS
+Hi-top Trainers, Combat Pants (Brown), Combat Pants (Khaki), T-shirt (Gray), T-shirt (White)

11 Sep, 2024
2:59pm
Gift sent to and redeemed by ykxm9tay
-Terra Incognita Chapter One: The Descendant

11 Sep, 2024
3:01pm
Gift sent to and redeemed by 0gn4i1xf
-Red Lake
-
Followed by many items being listed.

Going to the last ones before i started canceling whereafter no more listings.
-
12 Sep, 2024
2:28am
You listed an item on the Community Market.
-

12 Sep, 2024
2:29am
You purchased an item on the Community Market.
+Armlet of Discord

12 Sep, 2024
9:12am
You canceled a listing on the Community Market. The item was returned to you.
+Balkan
-


You are completely right we are compromised, it's like getting your car radio stolen. You think that won't happen to you. Unlike the car radio being stolen the damage to my inventory was minor.
I had no recollection of letting a platform access my steam, after backtracking it appears to be the website swap dot gg. Uncharacteristically I must have been so morning after night shift hour and a half drive home liquored out that I somehow after a game of Counter Strike must have thought it was a good idea to let a completely random website access my Steam.
We can at least conclude that my phone is not compromised.
While it does sound logical that this is the cause of course I can not confirm it is because of the website swap dot gg. Backtracking has also led us to believe the confusion that my other post caused must have been me confusing AM and PM.

tl;dr ♥♥♥♥♥♥ up ni87a
It is comforting to hear that this happens a lot. Thanks for your time together, all of us. We have secured my account and have made steps into identifying the culprit.

[Shady Knights]

https://www.scamadviser.com/check-website/swap.gg

Trust score 1 out of 100. As dodgy as you can imagine.


I think Steam would be better off locking all trades on account unless the end user unlocks it with the phone app (only applies when 2 factor security is enabled).

Selling lots of stuff and having to constantly authorize is a PITA, so having it on constantly is not what I am recommending. It would be only something that the proven account owner on the phone can toggle off for a brief period of time to sell their items. When they don't do this, it goes to the default which mandates approval via the app.

If it worked like this, you'd have got a bunch of authorization requests which is what you are expecting.

Yep, you made a mistake, Steam still could do a lot better though to block scammers like this.

[fyserium - ✓ᵛᵉʳᶦᶠᶦᵉᵈ OG]

Originally posted by Shady Knights:

https://www.scamadviser.com/check-website/swap.gg

Trust score 1 out of 100. As dodgy as you can imagine.


I think Steam would be better off locking all trades on account unless the end user unlocks it with the phone app (only applies when 2 factor security is enabled).

Selling lots of stuff and having to constantly authorize is a PITA, so having it on constantly is not what I am recommending. It would be only something that the proven account owner on the phone can toggle off for a brief period of time to sell their items. When they don't do this, it goes to the default which mandates approval via the app.

If it worked like this, you'd have got a bunch of authorization requests which is what you are expecting.

Yep, you made a mistake, Steam still could do a lot better though to block scammers like this.

In C:\Program Files\Common Files the folder PUBG was found containing two files: Uninstaller.exe and another .exe, in the rush I ran uninstaller and the folder got deleted.
The before mentioned folder location is shared by like only 5 other folders including folders named: system, Norton Security and opvn-dco. opvn-dco contains a folder named Win11 containing three files these being a .cat, .inf and .sys
Unrelated but nonetheless that whole having the steam accessed has put me on alert mode these Chinese are very advanced.

[DRIFTER]

I feel like there are important details missing in this story.

For example, do you know each one of the people in your friends list?
Who is this strange looking private profile? https://steamcommunity.com/profiles/76561198060563685

What chat conversations have you had on steam?
Did anyone ask you to vote for their team or artwork?
That is to say, have you clicked any links via steam chat?

What about discord? Is your steam linked to a discord account?
Have you had any chats on discord involving voting / trading / clicking outbound links?
A very common discord scam has been steam wallet code giveaways that go to mispelled sites like steamcomunity dot com or similar, and these steal your information.

Someone got your token and that was all they needed.
Did you use your 2FA to log into anything prior to this incident?
They can't get in without it, so you had to have given it out somehow.