Russian bot/hacker/scammer entered my account and sold half of my inventory.

[HachikoMKD]

So, yesterday I went to sleep knowing my account is "safe", however, that wasn't the case. This morning I'm greeted by bunch of email that "I've successfully sold my items on the market and bought some random Dota 2 thing that's worthless ( 0.02$ ) for 5$ ". I opened my inventory and saw that half of my CsGo skins are gone. Usp, Glock, Five7, Tec9, Ssg, Sg, etc.. I went to market page and saw that there's a Dota 2 thing bought that I still have in my inventory.
My question is.. How can someone bypass every single security that Steam offers and sell my items without any confirmation popping up on my Steam app? I went into Steam Guard and there is a "approved" log in for my account from my phone to a computer located in "Yekaterinburg, Sverdlovskaya, Russia" with the IP address "89.23.100.123". How is this possible? I didn't approve any log in from my phone app, nor from my email or anywhere else. How did they managed to bypass everything and just sell the items and transfer the money to their account?
Anyone experienced something like this? Also.. Skins worth 2-3$ were sold for 0.25, 0.8 and similar prices just to do the job the most efficient way and to steal the money without taking them longer than 5 mins. I didn't receive any confirmation notification on my app as well, while when I try to sell something even for stickers I'm being asked to confirm on my phone.

[ShelLuser]

Most likely the result of visiting a scam website, logging into your Steam account and by doing so giving away all your credentials for them to (ab)use. No lock will keep you safe if you give away the keys to the kingdom.

What does this URL tell you: https://steamcommunity.com/dev/apikey

... most likely you'll find one or more entries in there; that shouldn't be the case. Thing is: such API keys don't get there on their own.

[Lilim]

Originally posted by HachikoMKD:

My question is.. How can someone bypass every single security that Steam offers and sell my items without any confirmation popping up on my Steam app?

Most likely through phishing, as ShelLuser already said.

Have you secured your account in the meantime?

[HachikoMKD]

Originally posted by ShelLuser:

Most likely the result of visiting a scam website, logging into your Steam account and by doing so giving away all your credentials for them to (ab)use. No lock will keep you safe if you give away the keys to the kingdom.

What does this URL tell you: https://steamcommunity.com/dev/apikey

... most likely you'll find one or more entries in there; that shouldn't be the case. Thing is: such API keys don't get there on their own.

I haven't visited any site at all or log in with this account anywhere. This account is used only on 2 computers which is my main Desktop and my Laptop. That's it. I don't gamble or go to sites that promise "free stuff", "giveaways" or anything like that. Also, what's that link? It says to register my API which I don't really know what's that to be honest.

[HachikoMKD]

Originally posted by Lilim:

Originally posted by HachikoMKD:

My question is.. How can someone bypass every single security that Steam offers and sell my items without any confirmation popping up on my Steam app?

Most likely through phishing, as ShelLuser already said.

Have you secured your account in the meantime?

I did change the password and deactivate and activate the Steam mobile guard again but that's all I can really do..

[Lilim]

Originally posted by HachikoMKD:

I did change the password and deactivate and activate the Steam mobile guard again but that's all I can really do..

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Do not trade until your account is secured.


Disabling and re-enabling Steam Guard was a bad idea:

If you have recently enabled Steam Guard via email on your account, you will be unable to use the Community Market for the 15 days after Steam Guard was enabled. Removing Steam Guard or disabling and re-enabling Steam Guard will also trigger this restriction.

[ShelLuser]

Originally posted by HachikoMKD:

This account is used only on 2 computers which is my main Desktop and my Laptop. That's it. I don't gamble or go to sites that promise "free stuff", "giveaways" or anything like that.

Then you'll need to verify the integrity of those PC's because somehow the "bad guys" managed to get into your Steam account. One possible cause is phishing, as mentioned above, but if that doesn't apply then they managed in another way, leaving your local security measures.

Originally posted by HachikoMKD:

Also, what's that link? It says to register my API which I don't really know what's that to be honest.

The Steam API key; Steam provides an API that allows you to access your account data from a remote location through use of the API. Of course such requests need to be authenticated, which is where the API key comes in.

Normally you don't need this, but scammers and phishers use this method to gain "background access" to accounts. So you try logging into a scam site, then they use that data to log into Steam using your account and place the API key.


However... I overlooked something in your original post: an API key wouldn't have given them access to also authorize trades. That only happens if you have full access to an account. Since I'm quite sure there's nothing wrong with Steam's line of security measures you really need to triple check yours.

[HachikoMKD]

Originally posted by Lilim:

Originally posted by HachikoMKD:

I did change the password and deactivate and activate the Steam mobile guard again but that's all I can really do..

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Do not trade until your account is secured.

Thank you for the help.
1. I do have Malwarebytes installed both on the computer and the browser itself.
2. Email and phone number are still the same.
3. I did that earlier today but will do it once again.
4. I did that about an hour ago.
5. Will do this.
6. There isn't any key.

[HachikoMKD]

Originally posted by ShelLuser:

Originally posted by HachikoMKD:

This account is used only on 2 computers which is my main Desktop and my Laptop. That's it. I don't gamble or go to sites that promise "free stuff", "giveaways" or anything like that.

Then you'll need to verify the integrity of those PC's because somehow the "bad guys" managed to get into your Steam account. One possible cause is phishing, as mentioned above, but if that doesn't apply then they managed in another way, leaving your local security measures.

Originally posted by HachikoMKD:

Also, what's that link? It says to register my API which I don't really know what's that to be honest.

The Steam API key; Steam provides an API that allows you to access your account data from a remote location through use of the API. Of course such requests need to be authenticated, which is where the API key comes in.

Normally you don't need this, but scammers and phishers use this method to gain "background access" to accounts. So you try logging into a scam site, then they use that data to log into Steam using your account and place the API key.


However... I overlooked something in your original post: an API key wouldn't have given them access to also authorize trades. That only happens if you have full access to an account. Since I'm quite sure there's nothing wrong with Steam's line of security measures you really need to triple check yours.

The only thing I can think of is the "KMSpico" on my computers. That's the only "pirated" thing that I use to activate the Windows. Everything except that is either payed or free version of the product. However, I use KMSpico for over 10 years and never had any problem with any of my accounts anywhere on the internet. Anyways, thank you for the help. I hope I "kicked" the person that had access to my account and he won't do anything worse than this in the future.

[Lilim]

Originally posted by HachikoMKD:

That's it. I don't gamble or go to sites that promise "free stuff", "giveaways" or anything like that.

Were you asked by a Steam friend to vote for their team or to join a tournament? Did you use any third-party sites for trading?

[HachikoMKD]

Originally posted by Lilim:

Originally posted by HachikoMKD:

That's it. I don't gamble or go to sites that promise "free stuff", "giveaways" or anything like that.

Were you asked by a Steam friend to vote for their team or to join a tournament? Did you use any third-party sites for trading?

No, I have only 5 friends that I play with and they're my real life friends as well. They don't participate in any kind of tournament or anything of that kind. Like I said previously, I didn't, I don't and I won't use any third-party sites to trade items on. I only use Steam and that's it. That's why I'm surprised how someone got control over everything on my account because I don't log in anywhere except 2 browsers and 2 steam clients.