Someone attempted to access my account

[Redrick]

I got one of those 'Access from a new computer' emails from Steam that wasn't me..

I am disturbed by this because it said that my password was correctly used. Why I find this disturbing is because

- I have never given my password to anyone, ever
- My password is virtually impossible to guess or even brute force because of its composition.
- I have never linked my account into a 3rd party website or any such thing
- My PC has no malware

I have no clue how the attacker got my password. My question to the community is, is this common ?

[Waryth]

You don't have to be hacked in order for people to access/attempt to access your account. There are some websites that get data breached.

Check it here if your account has been exposed: https://haveibeenpwned.com

[Dr.Shadowds 🐉]

Just gonna copy, and paste it.

Originally posted by Dr.Shadowds 🐉:

Here are the most common reason people get accounts hijack for any service really are as followed.
- Sharing account infomation with others. <--- Very common with impersonators, pretending to be Steam admin / support.
- Logging in on phishing sites. <--- Very common with skin gambling sites.
- Downloading / Installing Virus / Keylogger on your system.
- Using public devices that has keyloggers, such as cyber cafe, school computers, and etc...
- Storing your login credentials on a unsecured service that others has access to view.
- Using same login credentials for all your things, or using same login credentials on another service that had a data leak. Yes it does matter because even if it not related to Steam, if using same login credentials, hijackers will try to use those credentials to see what services you use with those credentials. https://haveibeenpwned.com/

https://youtu.be/9TRR6lHviQc

The type of story scammers say to you.

- "Hey vote for my team", and they link you a phishing site link, and try get you to login.

- "Hey I can't add you, please add me", and they try to start their scam with you.

- If you're friend with someone that got their account hijacked, you get scam message like, "I report you", "you been banned", and whatever to try scare you, and they tell you to trade your items to them, or if you have a login to phishing site may have a API key on account that redirect trades, they ask you to give them money, or etc...

- If you already got your account compromise by them, they change your display name to banned, or whatever, your display picture as well, they may delete your friends, and try to spend your wallet funds if you have any, also trade all your items, but if they see if you have mobile authenticator attached, they play their scam to get you to confirm the trade to get your items off your account to their account quicker if they're able to trick you into confirming the trade.


I show you few examples.
https://steamcommunity.com/sharedfiles/filedetails/?id=2329645315

https://youtu.be/JuWHCBeZrqI
https://www.youtube.com/watch?v=kook1DlxDAw
https://www.youtube.com/watch?v=0DDnV-MHSaY
https://www.youtube.com/watch?v=WfTXxLraokE

https://steamcommunity.com/discussions/forum/1/4956744526904317093/#c4956744526904653890

[Reaper]

Originally posted by Cleaner-667:

I got one of those 'Access from a new computer' emails from Steam that wasn't me..

I am disturbed by this because it said that my password was correctly used. Why I find this disturbing is because

- I have never given my password to anyone, ever
- My password is virtually impossible to guess or even brute force because of its composition.
- I have never linked my account into a 3rd party website or any such thing
- My PC has no malware

I have no clue how the attacker got my password. My question to the community is, is this common ?

No it's not common, and that's exactly why I don't believe you. Steam would warn it's users if it had a data breach. Any website that wants to maintain it's userbase would. The fact that there's not some huge announcement saying people need to change their passwords or massive amounts of posts in the forums means there hasn't been any breach. That leaves only two options. You either gave your information out or it was easy to guess.

[Insomnia]

Originally posted by FeaR_TH3_Reap3R:

Originally posted by Cleaner-667:

I got one of those 'Access from a new computer' emails from Steam that wasn't me..

I am disturbed by this because it said that my password was correctly used. Why I find this disturbing is because

- I have never given my password to anyone, ever
- My password is virtually impossible to guess or even brute force because of its composition.
- I have never linked my account into a 3rd party website or any such thing
- My PC has no malware

I have no clue how the attacker got my password. My question to the community is, is this common ?

No it's not common, and that's exactly why I don't believe you. Steam would warn it's users if it had a data breach. Any website that wants to maintain it's userbase would. The fact that there's not some huge announcement saying people need to change their passwords or massive amounts of posts in the forums means there hasn't been any breach. That leaves only two options. You either gave your information out or it was easy to guess.

Not true at all, I don't believe steam has had a data breach, However the amount of companies that don't say there has been a breach for ages is insane. Sony for example. Some even keep it to themselves for years. It's actually more common not to announce it when they first find out, it's a massive issue.

Even Facebook didn't tell people recently when they first found out.


OP are you sure the email isn't fake? You get emails like that that try to phish you.

[Redrick]

Originally posted by FeaR_TH3_Reap3R:

No it's not common, and that's exactly why I don't believe you. Steam would warn it's users if it had a data breach. Any website that wants to maintain it's userbase would. The fact that there's not some huge announcement saying people need to change their passwords or massive amounts of posts in the forums means there hasn't been any breach. That leaves only two options. You either gave your information out or it was easy to guess.

Not implying a steam data breach, not sure where you got that idea, lol.
Only that somehow an attacker tried to login as me.

Originally posted by Insomnia:

OP are you sure the email isn't fake? You get emails like that that try to phish you.

Impossible to say, could be i guess, it sure looks legit. <removed>
I've checked the email headers they do appear to come from Steam.


Regardless I'm not going to stress over it, my account was not actually taken only an attempt, I've changed my steam/email pwd and validated no keyloggers on my machine.

[Dr.Shadowds 🐉]

Rule of thumb don't display in login name. Would suggest make edit to that screenshot, to cover that part.


Also email looks fine, but anyways my tip is never click on links for emails, as better to go directly to site yourself, so you know you're on the legitimate site. As there are phishing sites, and emails, as some email services has an issue where scammer can spoof the sender to say whatever they want making you think it from legit email.

If you believe someone got on your account for Steam, just follow these steps.
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Also I suggest reading my old post above #2.

[Redrick]

Thanks, fair point, I might consider changing my general display name as its basically the same, albeit has been for 10 years with no issue.

I did action all those, confirmed no malware, deauth'd all other devices (it said there were none)

Yea I read through your earlier post, pretty sure none of that applies to me, i'm just a low key sh**-kicking user who only uses steam to play games. Aside from game discussions I dont get involved in any of those other things or share accounts or any of that stuff, least of all 3rd party. That's why I'm scratching my head. If I'd done anything at all to make me stop and go 'oh, mabye it was that' I would never have bothered starting this thread.

But whatever, I must have obviously zigged somewhere where I should have zagged. So be it... lesson learned to stay vigilent.

[simeon369]

when you read the part about "They try to get you to log into an external site" by saying things like "Hey, Vote for my team, we only need 2 more votes to qualify" and you only read this 5 days after and realise you avoided getting your account stolen by saying "Nah, i don't play that ♥♥♥♥ game"

kinda makes sense that the Guy blocked me now... be careful who you play Stellaris and Crusaders kings with i guess....

I wanna add that i mainly said "Nah, i don't play that ♥♥♥♥ game" because i'm smart enough not to use my Steam account or any other account on an external site... honestly didn't click that he was trying to steal my account. :D