New trade offer scam method

[Dook Of Inferno]

Curious if anyone has seen a trade offer scam where they intercept an outgoing trade. My friend was trading me some TF2 keys that I gave him a while back. He went to our text chat on steam and right clicked my profile to send trade offer. After he sent the trade, he went to his app and accepted the trade offer. A few minutes go by and we can't see the keys in either of our inventories. My friend eventually looks at his trade history and sees that our trade was cancelled but that there was a trade between him and an unknown account that he isn't friends with. We look at the profile and his previous alias was my name and in his inventory he has all my keys. What are the possibilities of that? Is there a chance my friend's computer is compromised?

[Supafly]

Friends account has been hijacked likely cause is he gave a phishing site his login details. That allowed them to access his account. Then when he sent a trade to your account the hijackers BOT cancelled it. It then modified their account to look like yours and resent the trade all with a few seconds so he didn't notice a delay. He then ignored the warning about the target NOT being a friend and confirmed the trade.

Items are gone. Report the account that received them, block, move on and stop

Logging in on dodgy sites
Believing stupid messages on your profile
Confirming trades Without paying attention to the warnings and checking them.

Should also do these to secure his account
Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey

[Wolf Knight]

Steps to take NOW to secure the account:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Please review how you are logging into Steam, you somehow gave them your log in information. This could of been due to the computer being compromised and redirecting to a fake login, or you using a 3rd party site to login to steam.

its been going on for a while now. the trade is not intercepted, it is simply cancelled and a new one created going to the scammers account. they have a bot monitoring the account and when you make a trade, it copies the original accounts name and avatar onto the scammers account.

[Supafly]

Originally posted by karYzan:

Originally posted by Wolf Knight:

Steps to take NOW to secure the account:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Please review how you are logging into Steam, you somehow gave them your log in information. This could of been due to the computer being compromised and redirecting to a fake login, or you using a 3rd party site to login to steam.

its been going on for a while now. the trade is not intercepted, it is simply cancelled and a new one created going to the scammers account. they have a bot monitoring the account and when you make a trade, it copies the original accounts name and avatar onto the scammers account.

Please clarify. This happend to me. But the trade offer I accepted on my phone was MY account, I saw the common friends and everything. But the account it went to was completely different from the first get go.

Your account has been hijacked, likely cause is you gave a phishing site you login details. That allowed them to access your account. Then when you sent a trade to your other account the hijackers BOT cancelled it. It then modified their account to look like yours and resent the trade all with a few seconds so you didn't notice a delay. You then ignored the warning about the target NOT being a friend and confirmed the trade.