WTF IS HAPPENING!!??

[Giant Duck]

I have an alt steam account and decided to send my graffiti and steam backgrounds from this account to my alt because I wanted to clean my inventory, so I made the trade and sent it then I notice it took a while for me to get the confirmation on the mobile app (NOT NORMAL) but then I clicked on it to confirm and it said “blue frog is not on your friends list and he recently changed his account name” (blue frog is the name of my alt) i was confused and clicked on blue frogs profile thinking it’s my other account and it wasn’t my ACCOUNT. It was a different account with the same name!!!! So I went back into my trade history and saw that my trade offer to my alt was cancelled and I was sent another exactly the same offer from a different account!! WTF. The account has also been named CS.Money BOT #3 and some other stuff. This actually scared the ♥♥♥♥ out of me... I have a relatively expensive inventory and started to think hat if I offered my knife! ALSO HOW CAN SOMEONE ELSE CANCEL A TRADE OFFER BETWEEN ME AND SOMEONE NOT THEM!?’vb

[măgurel]

Same problem here with my 120€ inventory on csgo...

[Jerry]

Hirak0 eredeti hozzászólása:

Same problem here with my 120€ inventory on csgo...

You have entered your login data into a malicious site, knowingly or not. Now a bot is monitoring your account and forwards all trades to a dummy account that impersonates your trade partner.

Do all of the following steps in short order to lock out the bot:
- Check your system for malware
- Change your password and email adress
- Deauthorise all other devices
- Revoke your API key

[Muppet among Puppets]

Create new backup codes as well, or forget the steps you did already

[măgurel]

Jerry eredeti hozzászólása:

Hirak0 eredeti hozzászólása:

Same problem here with my 120€ inventory on csgo...

You have entered your login data into a malicious site, knowingly or not. Now a bot is monitoring your account and forwards all trades to a dummy account that impersonates your trade partner.

Do all of the following steps in short order to lock out the bot:
- Check your system for malware
- Change your password and email adress
- Deauthorise all other devices
- Revoke your API key

Ok so I found the problem
I logged into a site that imitates CSMoney, and boom lost my inventory when I traded with the real bot. The trade redirected to a fake bot so my items, lost forever, thanks btw <3

[The Giving One]

Hirak0 eredeti hozzászólása:

Ok so I found the problem
I logged into a site that imitates [REMOVED], and boom lost my inventory when I traded with the real bot. The trade redirected to a fake bot so my items, lost forever, thanks btw <3

See this post, as it is probably what happened exactly in your case :

https://steamcommunity.com/discussions/forum/1/1729827777337661675/?ctp=2#c1744479063999632396

[măgurel]

The Giving One eredeti hozzászólása:

Hirak0 eredeti hozzászólása:

Ok so I found the problem
I logged into a site that imitates [REMOVED], and boom lost my inventory when I traded with the real bot. The trade redirected to a fake bot so my items, lost forever, thanks btw <3

See this post, as it is probably what happened exactly in your case :

https://steamcommunity.com/discussions/forum/1/1729827777337661675/?ctp=2#c1744479063999632396

Done, thanks again <3

[Tipss]

cSg|mc-Hotsauce eredeti hozzászólása:

Break the Bed eredeti hozzászólása:

Did you ever find out what was wrong? This happened to me, except during a really expensive trade with someone and now I'm on the verge of being banned by Steam Rep for it because unlike your situation, I was unlucky enough to accidentally accept the trade in my confusion. I'm personally suspicious of the person that originally wanted the hat, but I don't have any really strong proof.

Break the Bed eredeti hozzászólása:

The reason I think this is because the account that got the hat only has one alias, and it was the name of the account of the original user that wanted the hat, the account did not change its username in order to mimic who I was trading, it seemed to be an account specifically made to become a duplicate of the original person and only started to become trading-active two days before.

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes.

Revoke the api key https://steamcommunity.com/dev/apikey

:qr:

So this is really ♥♥♥♥♥♥.

Same as stated in above, think i have malware on my pc because of clicking on a trade offer link the guy I wanted to trade with sent me.
Tried following the steps above ^^^ but no malware is being detected...

Anyone have an idea what could be wrong?

Was lucky enough to see it in time otherwise 1200 euros would have been given away..

[Wolf Knight]

Tip eredeti hozzászólása:

cSg|mc-Hotsauce eredeti hozzászólása:

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes.

Revoke the api key https://steamcommunity.com/dev/apikey

:qr:

So this is really ♥♥♥♥♥♥.

Same as stated in above, think i have malware on my pc because of clicking on a trade offer link the guy I wanted to trade with sent me.
Tried following the steps above ^^^ but no malware is being detected...

Anyone have an idea what could be wrong?

did you go thru all the other steam and secure the account? the malware scan is mainly a safety precaution.

worse case is you need to reformat/reset the OS to factory new and reinstall steam and your games. if you are on windows 10, its not as painfull as it sounds (about 30 minutes for the OS to reset vs 1 or 2 hours for windows 8)

[Tipss]

How would I exactly secure the account? Haven't heard of it.

If you mean changing my password and linked email then no. Was waiting for a response hehe..

[Wolf Knight]

Tip eredeti hozzászólása:

How would I exactly secure the account? Haven't heard of it.

If you mean changing my password and linked email then no. Was waiting for a response hehe..

to secure the account:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[Tipss]

All I have done at the moment is the malware scan. Could you inform me if there is a way to bypass the scan if there were to be malware on my pc?

Ran 2 different anti virus / malware scans and both showed clean.

[Muppet among Puppets]

Do the steps on a secure computer.

Did you install something or logged in "steam" not in the client or the homepage you reached by using your bookmark?

[Jerry]

The malware check is more of an additional security part in the list of common steps for this scheme. There are no known cases, where the hijacking was combined with malware, but it does not hurt to check, and if you got any other baddies on your computer, you spot them this way.

The steps that come after that are more important to clean your account.

[Tipss]

Muppet among Puppets eredeti hozzászólása:

Do the steps on a secure computer.

Did you install something or logged in "steam" not in the client or the homepage you reached by using your bookmark?

Jerry eredeti hozzászólása:

The malware check is more of an additional security part in the list of common steps for this scheme. There are no known cases, where the hijacking was combined with malware, but it does not hurt to check, and if you got any other baddies on your computer, you spot them this way.

The steps that come after that are more important to clean your account.

Have not logged in to any other sites or installed anything. It was 100% the link I clicked that was immitating a steam trade offer url. Looked like it aswell.

Going to take the secure steps on a laptop I have and we'll see what happens.

Just to be sure tho, by deactivating all other devices i will deactivate the steam guard for my phone aswell. Couldnt this be the one barriere between me and canceling the trade offers which are redirected to the bot? Or is it not possible for the bot to send a trade offer without my knowing

[Jerry]

Tip eredeti hozzászólása:

Just to be sure tho, by deactivating all other devices i will deactivate the steam guard for my phone aswell.

Erm, nope. Your mobile authenticator will remain intact, it is only all other computers, your account is logged in, that will be logged out this way. Make sure to do it not more than a few minutes apart from changing your password, as these two steps are only effective when working together.

P.S.: If you did remove your mobile authenticator, you would be back to email confirmations and 15 day trade holds. In the specific case of this hijacking an even better protection for your account.