Someone keeps hacking my account

[petervautier]

For the last 2-3 weeks my account keeps getting hacked, within a day of me changing the password. My passwords are strong, with a mix of letters, numbers and symbols.
I have scanned my computer with about 5 antiviruses and malware scanners and rootkit scanners, and nothing has been found. I have Steam Guard, so I get text messages and emails informing me of this.
I'm getting confused because no attempt has been made to purchase anything, and I am wondering if it is a false alarm? My passwords are really hard to crack, so I don't know how they would do it.
I have a VPN, so I am wondering if Steam is thinking that the VPN is another computer,? but my VPN is supposed to go through the USA, but the computers that are logging in are in Europe, mostly Switzerland....

Would appreciate some advice!

[petervautier]

PS: the times I get hacked are often times when I am not using my computer...

[Supafly]

When you get compromised you need to do everything in this list

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey


If you didn't do the last one then no matter how many times you change password it won't matter because hijackers can still access your account using your API key

[ADAM96]

i think making your password stupidly complex will solve this

[petervautier]

Ok, I don't know what an API key is but I will find out and do all the steps above.
My password really is stupidly complex. Even I can't figure it out sometimes!

[Cathulhu]

If you don't know what it is, you don't need one. If you have one, revoke it.
No need to create one.

[Supafly]

Originally posted by petervautier:

Ok, I don't know what an API key is but I will find out and do all the steps above.
My password really is stupidly complex. Even I can't figure it out sometimes!

Precisely why you should revoke it if you have one.

[Count_Dandyman]

Originally posted by petervautier:

Ok, I don't know what an API key is but I will find out and do all the steps above.
My password really is stupidly complex. Even I can't figure it out sometimes!

If it's that complex where are you keeping your reminder of it because if it's physical someone near you may be seeing it and if it's digital the hardware or service it's on may be compromised and leaking it.

[petervautier]

Yeah, I haven't got an API: it was asking me to set one up. So I figured if someone else had already it would indicate so. So I'll leave that as it is. As for my PW I only use the PC at home, and nobody here will have seen it. I was keeping the password on a password manager on my PC, but maybe I'll put the new pw on a piece of paper.
It just seems strange that every time I change it the new pw gets figured out within a day... almost like they are targeting me. My computer really seems to be clean so that's why I'm wondering if it's a false positive.

[Supafly]

Originally posted by petervautier:

Yeah, I haven't got an API: it was asking me to set one up. So I figured if someone else had already it would indicate so. So I'll leave that as it is. As for my PW I only use the PC at home, and nobody here will have seen it. I was keeping the password on a password manager on my PC, but maybe I'll put the new pw on a piece of paper.
It just seems strange that every time I change it the new pw gets figured out within a day... almost like they are targeting me. My computer really seems to be clean so that's why I'm wondering if it's a false positive.

Are they actually accessing your account? or is it one of those someone from x location tried accessing it but failed emails?
Are the emails from Steam? Phishers can make them seem official hoping to click a link and DL or change password so they get access.

[petervautier]

Stuff I've run on my computer:
Windows defender (updated definitions)
Malware bytes
Malware bytes rootkit remover
CC Cleaner
Spybot S&D (incl rootkit scan and immunisation)
McAffee Rootkit remover

Also had Zone Alarm installed but wasn't using it - have re-enabled it (Windows Firewall was switched on before)

[petervautier]

Originally posted by Suicidal Monkey:

Are they actually accessing your account? or is it one of those someone from x location tried accessing it but failed emails?
Are the emails from Steam? Phishers can make them seem official hoping to click a link and DL or change password so they get access.

I get variations of this:

This email was generated because of a login attempt from a computer located at (x location). The login attempt included your correct account name and password.

The Steam Guard code is required to complete the login. No one can access your account without also accessing this email.

If you are not attempting to login then please change your Steam password, and consider changing your email password as well to ensure your account security.

[76561198048932048]

Hey!
It's the same for me, since few days my password is changed and I don't have any alert emails or Steam Guard emails. I DON'T have any virus or malwares, I use 2 step authentication for my emails, and I use Steam Guard, but I don't receive any alerts of changing password, but I receive them well when I change my password... It's like someone changes my password with another way of steam website. It's very strange.

[Zekiran]

Originally posted by jeanmich:

Hey!
It's the same for me, since few days my password is changed and I don't have any alert emails or Steam Guard emails. I DON'T have any virus or malwares, I use 2 step authentication for my emails, and I use Steam Guard, but I don't receive any alerts of changing password, but I receive them well when I change my password... It's like someone changes my password with another way of steam website. It's very strange.

Then do the above list of things to do when your account's been compromised.

It really is that simple: keep your trades on Steam only, to friends only, never use off-steam sites AT ALL, and NEVER give your steam creds in any way shape or form to any other site than steam when you must log in.

[[☥] - CJ -]

Are you sure they are legit Valve emails and not scam/Phishing emails?
Are you sure the emails you are getting arent for when you changed the password and the email is just late in being sent to you?

Accounts being used with Steam Guard enabled need the Guard characters to login/change something so i wouldnt be worried about steam guard protected accounts.

The thing you may want to consider doing is logging out of your mobile devices and changing the account password of your apple/android account

[Razorfish]

WHY? are you using a VPN........ to run a game....