[HELP] I WAS TRADEBOT/CLONE SCAMMED/HACKED

[DesTruction-]

I don't know how, and I don't know if it could've happened. But I was recently moving my Counter-strike 2 items from my account to my brother's account (https://steamcommunity.com/id/IlhamHarahap30/). I had confirmed the trade, and then I confirmed on my brother's phone, and then I accepted his offer, however suddenly it told me that it counter-offered. I didn't assume much of it as I'm new to steam trading, and then when I checked it, I then realized it was another account named "Trade Offer" with the same profile picture of my brother's account. Please help me. (https://steamcommunity.com/id/evitahomyakov) This is the Fake Clone of my brother's account.

[Stoked]

This is the account that I was supposed to trade to.

[Stoked]

https://steamcommunity.com/id/evitahomyakov this is the clone

[J4MESOX4D]

You initiated a trade whilst your account was compromised. Scammers were able to intercept your intended target and clone the recipient. You then accepted the contaminated trade to the impersonators. Do the following steps to secure your account:-

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Items lost this way are not returned. You likely gave away your credentials to a phishing site previous or have tailored capture-based malware on your device.

[Stoked]

Originally posted by J4MESOX4D:

You initiated a trade whilst your account was compromised. Scammers were able to intercept your intended target and clone the recipient. You then accepted the contaminated trade to the impersonators. Do the following steps to secure your account:-

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Items lost this way are not returned. You likely gave away your credentials to a phishing site previous or have tailored capture-based malware on your device.

I did recently get my PC hacked, however I've already done all of that, and secured my account, the email and steamguard and the phone number are mine, however I never got to clear the api key.

[Stoked]

I just checked, my API key thing says register, doesn't that mean that the API key was never involved?

[J4MESOX4D]

Originally posted by Stoked:

Originally posted by J4MESOX4D:

You initiated a trade whilst your account was compromised. Scammers were able to intercept your intended target and clone the recipient. You then accepted the contaminated trade to the impersonators. Do the following steps to secure your account:-

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Items lost this way are not returned. You likely gave away your credentials to a phishing site previous or have tailored capture-based malware on your device.

I did recently get my PC hacked, however I've already done all of that, and secured my account, the email and steamguard and the phone number are mine, however I never got to clear the api key.

API key is what the scammers use to monitor all your account activity required to facilitate the scam. Sounds like they had botted access to your account the whole time after your PC was compromised and they were then able to intercept your trade offers and destinations by using data through the API.

[DesTruction-]

Originally posted by J4MESOX4D:

Originally posted by Stoked:

I did recently get my PC hacked, however I've already done all of that, and secured my account, the email and steamguard and the phone number are mine, however I never got to clear the api key.

API key is what the scammers use to monitor all your account activity required to facilitate the scam. Sounds like they had botted access to your account the whole time after your PC was compromised and they were then able to intercept your trade offers and destinations by using data through the API.

In this scenario, which would be the one that got hacked? the Valtus account or the Stoked..?

[DesTruction-]

Originally posted by Valtus:

Originally posted by J4MESOX4D:

API key is what the scammers use to monitor all your account activity required to facilitate the scam. Sounds like they had botted access to your account the whole time after your PC was compromised and they were then able to intercept your trade offers and destinations by using data through the API.

In this scenario, which would be the one that got hacked? the Valtus account or the Stoked..?

The stoked account rejected the offer and sent a counteroffer.

[J4MESOX4D]

Originally posted by Valtus:

Originally posted by J4MESOX4D:

API key is what the scammers use to monitor all your account activity required to facilitate the scam. Sounds like they had botted access to your account the whole time after your PC was compromised and they were then able to intercept your trade offers and destinations by using data through the API.

In this scenario, which would be the one that got hacked? the Valtus account or the Stoked..?

The account that had its trade offer cancelled and then clone is the one that's hijacked but it's still possible that both are affected. You accepted the trade which was to the scammers impersonating. I would carry out all the steps on both accounts.

Next time you must adequately vet the trade confirmation screen because it will give your a breakdown of the intended target and you should be able to determine from that if the account is legitimate or a targeted impersonator.

[DesTruction-]

Originally posted by J4MESOX4D:

Originally posted by Valtus:

In this scenario, which would be the one that got hacked? the Valtus account or the Stoked..?

The account that had its trade offer cancelled and then clone is the one that's hijacked but it's still possible that both are affected. You accepted the trade which was to the scammers impersonating. I would carry out all the steps on both accounts.

Next time you must adequately vet the trade confirmation screen because it will give your a breakdown of the intended target and you should be able to determine from that if the account is legitimate or a targeted impersonator.

Is there any way I can get my items back?

[J4MESOX4D]

Originally posted by Valtus:

Originally posted by J4MESOX4D:

The account that had its trade offer cancelled and then clone is the one that's hijacked but it's still possible that both are affected. You accepted the trade which was to the scammers impersonating. I would carry out all the steps on both accounts.

Next time you must adequately vet the trade confirmation screen because it will give your a breakdown of the intended target and you should be able to determine from that if the account is legitimate or a targeted impersonator.

Is there any way I can get my items back?

Unfortunately not https://help.steampowered.com/en/faqs/view/3B6E-B322-2400-8D24

All you can do is secure your account and ensure you are safe going forward by not giving away your credentials anywhere or installing harmful material.

[simon]

Originally posted by Valtus:

Is there any way I can get my items back?

No the items are gone. Use this experience as a life lesson and think about how you got your account compromised so you dont do it again.

[DesTruction-]

Alright, thank you for helping.

[simon]

Originally posted by Valtus:

Alright, thank you for helping.

Its tuff i know but thats life. Try not to take it too hard and learn from it.

[Bacon]

Originally posted by Stoked:

Originally posted by J4MESOX4D:

You initiated a trade whilst your account was compromised. Scammers were able to intercept your intended target and clone the recipient. You then accepted the contaminated trade to the impersonators. Do the following steps to secure your account:-

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Items lost this way are not returned. You likely gave away your credentials to a phishing site previous or have tailored capture-based malware on your device.

I did recently get my PC hacked, however I've already done all of that, and secured my account, the email and steamguard and the phone number are mine, however I never got to clear the api key.

GENUIENLY CURIOUS. Been PC gaming for 20 years, never been hacked. Why would you ever give your API or let a 3rd party use your credentials? its akin to letting someone borrow your ID cards in RL.