New? Scamming method

[railelele]

I got scammed by someone today on Steam
He stole all my cs:go items by trading but not in any known method by me.
He changed the steam mobile authenticator from my phone to his (i don't know how).
Steam automatically sends you a sms text on your phone if you change something about your authenticator and I didn't recieve any.
I wasn't even informed that my account is logged somewhere else.
So pay attention if your authenticator tells you that it's sending wrong codes (that't how i noticed that my auth doesn't work anymore).
I contacted steam support for any chance of getting a solution or even a response from them to explain to me how that could be possible.I don't think that they even know how.
I reported the guy and gave Steam his profile and they haven't banned him in any way so far.
Steam support became useless for anything right now because they don't move items from accounts nor duplicate them.

[cSg|mc-Hotsauce]

Not new at all. You gave away your account info at some point.

Your account is compromised.

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key https://steamcommunity.com/dev/apikey

Also, read up on the API scam...

https://www.reddit.com/r/GlobalOffensiveTrade/comments/a5t6kc/psa_huge_csgo_youtuber_fell_for_the_fake_site/

https://forums.steamrep.com/pages/hijacking/

[railelele]

I scanned it with mb be sure.I have nothing.
I deauthorized already.
I changed my password and reclaimed my steam mobile authenticator.
I revoked the api key.

But how did he get my auth code to enter the account in the first place?
And how did i not get the steam sms to change my authenticator?

[cSg|mc-Hotsauce]

引用自 railelele：

I scanned it with mb be sure.I have nothing.
I deauthorized already.
I changed my password and reclaimed my steam mobile authenticator.
I revoked the api key.

But how did he get my auth code to enter the account in the first place?
And how did i not get the steam sms to change my authenticator?

You gave away your... ugh... Did you read my entire reply?

[Aachen]

Sounds like the standard pattern of a phishing expedition, to me. Regardless .... what’s the suggestion?

Also: that support follows the item restoration policy in your case (as in others) doesn’t make ‘em useless.

[railelele]

What I said already is that even if some site knew my account information they can't get logged on my account if they don't have the mobile app code generated.
How did he manage to change the app from being on MY phone on HIS phone instead.

I suggest that you deauthorize all steam logins once in a while and check for suspicious activity on the mobile app asking you to confirm anything that you're not aware of.

[cSg|mc-Hotsauce]

引用自 railelele：

What I said already is that even if some site knew my account information they can't get logged on my account if they don't have the mobile app code generated.
How did he manage to change the app from being on MY phone on HIS phone instead.

I suggest that you deauthorize all steam logins once in a while and check for suspicious activity on the mobile app asking you to confirm anything that you're not aware of.

Read the last 2 links i posted for more info on the api scam.

[Aachen]

引用自 railelele：

.... I suggest that you deauthorize all steam logins once in a while and check for suspicious activity on the mobile app asking you to confirm anything that you're not aware of.

Valve should take those steps?

[railelele]

You are saying that I got scammed by that api thing but let me just say that I didn't recieve any fake trades and didn't log on suspicious sites.
Other than that, no one traded me anything recently and I haven't made any trades in the past month.So the Api scam kinda doesn't apply here.

[Quint the Alligator Snapper]

引用自 railelele：

But how did he get my auth code to enter the account in the first place?
And how did i not get the steam sms to change my authenticator?

Imagine a website. It looks like something interesting or useful to a Steam user -- let's say, a skin trading site or an esports tournament site.

Steam has a "Sign in through Steam" feature where you can pass your public account info to a thrd-party website. Legit third-party websites will use this so they can associate your account there with your Steam profile. But, websites don't need to be legit to have a button that says "Sign in through Steam". In fact, you can make webpages that look like pretty much anything these days.

So, now, this hypothetical website has a "Sign in through Steam" button. What happens when you click it? The site produces a new window with a "Sign in through Steam" prompt, that lets you sign in with Steam. ...well, actually, it's not a new window. It's a frame within that same webpage, but skinned to look like a new window, based on reading your browser's "useragent" string (which tells sites what browser you're using).

Also, suspiciously, it asks for you to put your Steam username and password. This would be suspicious if you were already logged into Steam in that browser of yours, because "Sign in through Steam". But since a lot of people use Steam's (crappy, IMO) built-in browser to browse Steam, they might not catch this, since even a legit "Sign in through Steam" would ask them for their username and password too.

So let's say you put in your username and password. It's not a real Sign in through Steam page, so what happens is that the website captures both, and then passes it to another computer that really is signing in on Steam. It inputs both and attempts to sign in. Now, Steam needs a mobile auth code, right? So, Steam asks that computer for a mobile auth code...and that computer tells the website to ask you for your mobile auth code...as part of that fake "Sign in through Steam" page.

[railelele]

Yes of course.But when it comes to accepting the trade they also need confirmation on my steam authenticator which they didn't get(that's what you're saying).What I am saying is that they succeded to change the app on my phone to be on their phone, passing the sms from steam which i didn't get.

[J4MESOX4D]

You gave away your login, password and live auth code to a phishing window and these were then instantly botted into a real client and your account was shadow-hijacked without your knowledge. That is an absolute certainty and this scam is very old and common.

You need to work out how this happened and how you allowed other things to occur. We've given you the basis but you need to work out how severely compromised you were and possibly still are in regards to other devices.

[Vivian]

Here is what I do I always login into the steam web version cause it can indicate which site is real and which site is not say like a trading site, when you click on the sign in through steam it should say something along the line of "is this you" that means it real and not a phishing site. But say like a hijacker sends you a link to a site you never seen before, make sure its legit by logging in into the steam web version then go back to that site the hijacker sent you. If it doesnt say "is this you" then its not real. Or just dont click on anything he sends you always ALWAYS have common sense and knowledge, things arent free.