Message Spam Vírus

[Givaldo150]

Last Saturday (Ago/12/22), one of my friends sent this message:

[Redacted by moderator]

I clicked due to him being an old friend, but then, it begun to be sent to my friends as me, almost all my friend were affected and they warned me about that, some of them helped me and i changed my acc credentials. I also saw in my "connected devices" in Steam info tab and there was a connected computer from Moscow, that i believe is where the attack was being made.

I don't know exactly what happened, and i also don1t know if it can further affect my account, i don't wnat to recieve a ban for that, so, i ask for help if someone knows what can i do in order to make everything more secure in my account, i already changed my password and Steam Guard is already active.
Also, if anyone see those kind of messages from your friends, don't clique on them, it may be the same virus/spam. Thank You.

[Wizardhermit]

Steps to take NOW:

1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a trusted/clean computer.
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[Givaldo150]

Originally posted by Wizardhermit:

Steps to take NOW:

1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a trusted/clean computer.
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

There was an API already installed, i never did it, it is a problem?
I did all of that, i scanned my PC and nothing apeared on the anti-vírus.
Thank You friend.

[Cathulhu]

Yes, it is. It is no longer a problem if you removed the API key.

[Dr.Shadowds 🐉]

Originally posted by Givaldo150:

There was an API already installed, i never did it, it is a problem?
I did all of that, i scanned my PC and nothing apeared on the anti-vírus.
Thank You friend.

Remove API key, should be none there.


Here some tips to help protect yourself on the internet.

Originally posted by Dr.Shadowds 🐉:

Here are the most common reason people get accounts hijack for any service really are as followed.
- Sharing account infomation with others. <--- Very common with impersonators, pretending to be Steam admin / support.
- Logging in on phishing sites. <--- Very common with skin gambling sites.
- Downloading / Installing Virus / Keylogger on your system.
- Using public devices that has keyloggers, such as cyber cafe, school computers, and etc...
- Storing your login credentials on a unsecured service that others has access to view.
- Using same login credentials for all your things, or using same login credentials on another service that had a data leak. Yes it does matter because even if it not related to Steam, if using same login credentials, hijackers will try to use those credentials to see what services you use with those credentials. https://haveibeenpwned.com/

https://youtu.be/9TRR6lHviQc

The type of story scammers say to you.

- "Hey vote for my team", and they link you a phishing site link, and try get you to login.

- "Hey I can't add you, please add me", and they try to start their scam with you.

- If you're friend with someone that got their account hijacked, you get scam message like, "I report you", "you been banned", and whatever to try scare you, and they tell you to trade your items to them, or if you have a login to phishing site may have a API key on account that redirect trades, they ask you to give them money, or etc...

- If you already got your account compromise by them, they change your display name to banned, or whatever, your display picture as well, they may delete your friends, and try to spend your wallet funds if you have any, also trade all your items, but if they see if you have mobile authenticator attached, they play their scam to get you to confirm the trade to get your items off your account to their account quicker if they're able to trick you into confirming the trade.


I show you few examples.
https://steamcommunity.com/sharedfiles/filedetails/?id=2329645315
https://steamcommunity.com/sharedfiles/filedetails/?id=2570975058

https://youtu.be/JuWHCBeZrqI
https://www.youtube.com/watch?v=kook1DlxDAw
https://www.youtube.com/watch?v=0DDnV-MHSaY
https://www.youtube.com/watch?v=WfTXxLraokE

https://steamcommunity.com/discussions/forum/1/4956744526904317093/#c4956744526904653890