Account got hacked? Help me please :)

[DJpeng]

I have steam Authenticator on, however, some dude from china (or thai idk) has been logging onto my account without my knowledge, and used all of my steam points for some reason to give awards to their community post/screenshots? I don't care about the points (though I would like them back) but how come other people are accessing my account when I have two factor auth on? I didn't get any notifications on my phone or in my emails. The fact that mutiple of his posts have like 60 awards must mean that 5 or 6 people got 'scammed'.

I haven't even used steam in a while, but was bombarded with 40 emails in Thai telling me I spent my steam points.

I also lost the 5$ I had in my steam wallet :(

Could anyone explain what's going on? also how do I post pictures?

[Frank ツ]

There are litterally millions of topics about this.

You have not been hacked, but hijacked.

You logged into a phising site

[magicISO Sweden]

then change password and secure your account

[magicISO Sweden]

dont use third party sites

[Crazy Tiger]

Phishing is the most likely cause, OP. When people get phished, they give out the account name, password and then active guard code. A bot quickly enters it and hijackers have access then. Ultimately 2FA is "just another code" that can be given away when getting phished. It's not a magical defense layer.

Secure your account:
- Scan for malware. https://www.malwarebytes.com/
- Deauthorize all devices https://store.steampowered.com/twofactor/manage
- Change your password on a secure device.
- Generate new back up codes. https://store.steampowered.com/twofactor/manage
- Revoke the api key https://steamcommunity.com/dev/apikey

Find out how you leaked your credentials. Phishing and malware are the two ways it happens, phishing is the most likely one. Either way, find out how you leaked your credentials.

[DJpeng]

Thank you for your comments, though I don't think It was phishing. I downloaded some youtube adobe stuff/absolutely nothing to do with steam, and many of my accounts got hacked soon after (insta, snap, discord, steam etc), I have different passwords for each app if that means anything. Also as mentioned before, I barely use/log on to steam anymore, I have not inputted my account into websites nor do I have any reason to log into a phishing website, for free games I assume? (malware download didn't require email or password input).

I understand that I brought this upon myself, just want to know why they didn't change my password/compromise my account and only took some steam points, or if I could get my points back.

tl;dr: didn't use a phishing website, hacked in another way? why only take steam points but nothing else, how to get steam points back.

[м]

引用自 DJpeng：

how to get steam points back.

Hey, you can't.

The only way to get some back would be to refund your last store purchase, which would take the points away that you've gained with it.

But I wouldn't recommend doing that.

[Muppet among Puppets]

引用自 DJpeng：

Thank you for your comments, though I don't think It was phishing. I downloaded some youtube adobe stuff/absolutely nothing to do with steam, and many of my accounts got hacked soon after (insta, snap, discord, steam etc)

The device is infected with a keylogger or remote access malware.

[prhempsis]

It happened to me just now, did you get your steam points back?

[J4MESOX4D]

引用自 prhempsis：

It happened to me just now, did you get your steam points back?

You don't.

[Lilim]

引用自 prhempsis：

It happened to me just now, did you get your steam points back?

Have you already secured your account (see the steps posted by Crazy Tiger )?

[könnn]

引用自 DJpeng：

Thank you for your comments, though I don't think It was phishing. I downloaded some youtube adobe stuff/absolutely nothing to do with steam, and many of my accounts got hacked soon after (insta, snap, discord, steam etc), I have different passwords for each app if that means anything. Also as mentioned before, I barely use/log on to steam anymore, I have not inputted my account into websites nor do I have any reason to log into a phishing website, for free games I assume? (malware download didn't require email or password input).

I understand that I brought this upon myself, just want to know why they didn't change my password/compromise my account and only took some steam points, or if I could get my points back.

tl;dr: didn't use a phishing website, hacked in another way? why only take steam points but nothing else, how to get steam points back.

Oh my, I have SAME PROBLEM. I watch video about Adobe Illustartor, and code was 2024. But before I did, I didn't allow it to make any changes in my hd. But after someone stole my ea account, supercell account, then log in insta and posted a story (about some crypto). At first I thought that something like trojan, miner. I quickly changed passwords to all of my accounts Facebook, Insta, Tweeter and Discord. And as I change I saw someone tried to log in my facebook and Tweeter account. So i was glad, that doesn't turn on bad. I forgot to change my steam account. And I was so afraid they could possibly change password and all. But they spend all my points, but gladly I get return. And now I hope they just give up. Cuz I don't know what elese they can hacked:/ (Pinterest maybe ahhaha)

[John]

This thread was quite old before the recent post, so we're locking it to prevent confusion.