Can someone do something about this 'mainfight' crap?

[Blitzz_]

I have lost like 20 friends because I clicked on a mainfight link and it normally only does something when you log into your account. But here's the thing, I NEVER LOGGED INTO MY STEAM ACCOUNT ON MAINFIGHT. So now someone is hacking me and asking all of my friends to vote for team Quartz. So all of my friends say that they don't trust the link. So I have lost like 20 friends from this crap. Can someone take action here? I don't wanna lose any more friends to this.

[Fake]

Secure your account. You gave away your account credentials. Hijackers are using your account to hijack those on your friend list.

[cSg|mc-Hotsauce]

ALL steps NOW!

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key https://steamcommunity.com/dev/apikey

[Quint the Alligator Snapper]

Did you log into your Steam account on a "sign in through Steam" page?

The scam you're talking about sounds like one that uses a fake page that looks like a real "sign in through Steam" page. That fake page is used to make people think they're signing into their Steam account on the Steam site...except it's actually a fake browser window, complete with address bar and security symbol to look real.

[cSg|mc-Hotsauce]

Clicking or tapping the link in the mobile app seems to automatically grab the login info. It was reported as an exploit 3 years ago.

[Quint the Alligator Snapper]

Originally posted by cSg|mc-Hotsauce:

Clicking or tapping the link in the mobile app seems to automatically grab the login info. It was reported as an exploit 3 years ago.

:qr:

OOF

Well I guess there is merit to the "don't even click on it" advice.

I was wondering whether there was some sort of password autofill going on, given that that's a very common browser feature these days that generally defaults to on...

[SaradMatthew007]

why would you click on a link without proper knowledge?

[cSg|mc-Hotsauce]

Originally posted by Quint the Alligator Snapper:

Originally posted by cSg|mc-Hotsauce:

Clicking or tapping the link in the mobile app seems to automatically grab the login info. It was reported as an exploit 3 years ago.

OOF

Well I guess there is merit to the "don't even click on it" advice.

I was wondering whether there was some sort of password autofill going on, given that that's a very common browser feature these days that generally defaults to on...

The fact that it also bypasses the nag screen letting you know you are leaving Steam is another issue.

But the exploit was out of scope for the bounty program because it was considered social engineering.

Hopefully the mobile app update, when it ever releases, will have this somehow patched. In ValveTime.

[Muppet among Puppets]

Originally posted by cSg|mc-Hotsauce:

Clicking or tapping the link in the mobile app seems to automatically grab the login info. It was reported as an exploit 3 years ago.

:qr:

Really?
The added security app with steam guard and stuff? The two factor app?
Leaks login details if you click a link, as if it wasnt 2fa?

For 3 years?


As i said, people with the app are targets, email auth was safer.

[LowJack_VA1]

Originally posted by cSg|mc-Hotsauce:

Originally posted by Quint the Alligator Snapper:

OOF

Well I guess there is merit to the "don't even click on it" advice.

I was wondering whether there was some sort of password autofill going on, given that that's a very common browser feature these days that generally defaults to on...

The fact that it also bypasses the nag screen letting you know you are leaving Steam is another issue.

But the exploit was out of scope for the bounty program because it was considered social engineering.

Hopefully the mobile app update, when it ever releases, will have this somehow patched. In ValveTime.

:qr:

3 YEARS and Valve is just ignoring it. Valve just doesn't care about the mobile app, thats why I deleted my suggestion about the mobile app.

[Muppet among Puppets]

Even most people who say how safe all this is could get in that trap.
But surely after they get told about it, they will just add another "do this to keep the safety app safe",
dont click links.

So far we know "dont login, dont agree to trades someone changed on your behalf unknowingly to you without indication, dont click links". Then you are safe with the auth app....... well, or without it to be honest.

[Quint the Alligator Snapper]

Originally posted by Muppet among Puppets:

Even most people who say how safe all this is could get in that trap.

And this is why I tell folks on the Steam forums to stop blaming victims and stop assuming that Valve is infallible.