Someone hacked into my account even with Steam Guard 2FA

[Johm]

Someone was able to get into my account without any warning, notification, or anything and ended up selling all of my inventory items that were under 50 cents to the steam market. All of the items collectively were $13 and he bought an item for that amount and sold it for 1 cent just to ♥♥♥♥ with me and not even give me the $13. What the hell even happened? How the hell did this happen?


I changed my password and everything. I even changed my 2FA number to a different one and reinstalled the mobile app on my phone. I'm just genuinely confused as to how my account could get compromised that way. I didnt click any links and I only sign into trusted websites with steam (even then im hesitant).

[Mr. Smiles]

"trusted websites" like...?

The only place you should be entering your steam login credentials... Is steam.

Anyway.

Steps to take NOW:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[B-o-B]

The buyer of the item wasn't a random, it will be linked to the thief.
Report the account the item went to.
Report a Scammer
https://help.steampowered.com/en/wizard/HelpReportScam

[Johm]

Originally posted by Mr. Smiles:

"trusted websites" like...?

The only place you should be entering your steam login credentials... Is steam.

sites like Steamrep and such.

[Johm]

Originally posted by B-o-B:

The buyer of the item wasn't a random, it will be linked to the thief.
Report the account the item went to.
Report a Scammer
https://help.steampowered.com/en/wizard/HelpReportScam

the hacker sold over 50 items. It would be impossible for me to scroll through all of them and report the accounts 1 at a time. They were all pretty much different.

[Stellar Remnant]

Someone hacked into my account even with Steam Guard 2FA

I find this idea highly unlikely. Unless PBKAC, that should not ever happen.

[Johm]

Originally posted by MiniHerc:

Someone hacked into my account even with Steam Guard 2FA

I find this idea highly unlikely. Unless PBKAC, that should not ever happen.

This is why im very very confused. They clearly didnt have access to my mobile authenticator unless my whole inventory would be gone which includes skins that need to be confirmed on the app. So, idk.

[ReBoot]

Originally posted by Johm:

Originally posted by MiniHerc:

I find this idea highly unlikely. Unless PBKAC, that should not ever happen.

This is why im very very confused. They clearly didnt have access to my mobile authenticator unless my whole inventory would be gone which includes skins that need to be confirmed on the app. So, idk.

They did. You gave them a code from your mobile authenticator!

[Smeevlin]

I'm not entirely sure about Steam's login and session processes, but I'd imagine some kind of malware on your computer grabbed your session token. I'm not going to go into complete detail, but this would've allowed them to completely bypass all security measures. It's as if they were using the Steam client on your PC.

I'd recommend following what Mr. Smiles posted:

Originally posted by Mr. Smiles:

Steps to take NOW:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[Johm]

Originally posted by Smelvin:

I'm not entirely sure about Steam's login and session processes, but I'd imagine some kind of malware on your computer grabbed your session token. I'm not going to go into complete detail, but this would've allowed them to completely bypass all security measures. It's as if they were using the Steam client on your PC.

I'd recommend following what Mr. Smiles posted:

Originally posted by Mr. Smiles:

Steps to take NOW:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

This was most likely the case and also makes the most sense. It was only like $13 in items so I'll be able to buy them again fairly easily, but man what a pain in the ass

[KalGimpa]

sorry this happened, partner.

the thing to remember is

nobody capable of hacking steam is going to waste it messing with your account

they will get in, scrape the site of all the truly useful, money making info and leave as quietly as they can and sell it

what happened to you was more than likely phishing. somewhere along the lines

people either log into one of these sites that offer free stuff or trading (these sites will sit on the info, sometimes for a long time, before attempting their scam. if they did it immediately, nobody would ever use them)

log into a page thinking it is a steam page, usually by clicking a link from a shady source

they gave their info to someone they thought was steam because of a scam

it is that or you had/have some kind of virus on your system. this is much less likely as phishing is the number one way that people are stealing accounts these days

[Johm]

Originally posted by KalCuey:

sorry this happened, partner.

the thing to remember is

nobody capable of hacking steam is going to waste it messing with your account

they will get in, scrape the site of all the truly useful, money making info and leave as quietly as they can and sell it

what happened to you was more than likely phishing. somewhere along the lines

people either log into one of these sites that offer free stuff or trading (these sites will sit on the info, sometimes for a long time, before attempting their scam. if they did it immediately, nobody would ever use them)

log into a page thinking it is a steam page, usually by clicking a link from a shady source

they gave their info to someone they thought was steam because of a scam

it is that or you had/have some kind of virus on your system. this is much less likely as phishing is the number one way that people are stealing accounts these days

Most likely a virus on my pc. My regular anti-virus wasn't picking up anything but I installed malwarebytes again and it picked up a bunch of stuff. Got all that out of the system so I hope nothing else happens.

[J4MESOX4D]

Either your credentials were captured with tailored malware sitting on your PC, or you gave them away including a live auth code to a phishing site previous, which were then login-botted into a real client and your account was shadow-hijacked.

There is no 'hacking'.

[Johm]

Originally posted by J4MESOX4D:

Either your credentials were captured with tailored malware sitting on your PC, or you gave them away including a live auth code to a phishing site previous, which were then login-botted into a real client and your account was shadow-hijacked.

There is no 'hacking'.

Hacking is just a basic term everyone generally used whenever an account gets logged into elsewhere. It was the malware one. I'd never log into a site where I'd have to put my auth code

[J4MESOX4D]

Originally posted by Johm:

Originally posted by J4MESOX4D:

Either your credentials were captured with tailored malware sitting on your PC, or you gave them away including a live auth code to a phishing site previous, which were then login-botted into a real client and your account was shadow-hijacked.

There is no 'hacking'.

Hacking is just a basic term everyone generally used whenever an account gets logged into elsewhere. It was the malware one. I'd never log into a site where I'd have to put my auth code

The problem is when people use the term 'hacking', it gives the impression that they have been brute-forced by a vulnerability in the platform. Many then believe that Steam is at fault and they don't learn from their mistake which can see them impacted the same way in the future. They also may not rectify the problem and remain compromised even after the scammers have completed their business.

Always best to use the term 'hijacking' in cases like these.

[KalGimpa]

Originally posted by Johm:

Originally posted by J4MESOX4D:

Either your credentials were captured with tailored malware sitting on your PC, or you gave them away including a live auth code to a phishing site previous, which were then login-botted into a real client and your account was shadow-hijacked.

There is no 'hacking'.

Hacking is just a basic term everyone generally used whenever an account gets logged into elsewhere. It was the malware one. I'd never log into a site where I'd have to put my auth code

it may seem like a small. semantic matter, but it is not

hacking and phishing are very different and need to be looked at that way to make sure people fully understand what is going on