I keep receiving log in requests even after changing my password.

[kavakader]

A few weeks ago I accidentally downloaded malware and every password on my laptop was stolen, 3 of my accounts were taken from me one of them being my Steam account, I contacted support and managed to get my account back however i received a log in request after changing my password thankfully I had steam guard this time. After changing my password I got another log in request the next day and the cycle just continues every time I change my password the within the next 2 days i get a new log in request from a different location every time.

Also i know a lot of things point to it being a key logger however, I completely wiped my laptop so that can’t be the case as well as the fact that whenever I change my password I do it on my phone and I haven’t really used Steam recently anyway so I haven’t retyped any of the passwords into my laptop. I also doubt my network has been infected as they haven’t tried to regain any of the other accounts or attempt to log in to any other of my accounts after I changed my password this only happens to my Steam account.

I don’t know what to do because I don’t see a way they could steal my password anymore yet they do every time and yes I’m not reusing my old passwords. My only guess is they stole a log in cookie but aren’t those supposed to expire.

I would appreciate any help.

[Aluvard]

Simply changing password does nothing. Follow steps 1-6 to secure your account:

1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
4. Change passwords from a trusted/clean device.
5. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
6. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

Regarding items:
https://help.steampowered.com/faqs/view/3B6E-B322-2400-8D24

Also change your email password from safe device.

[wuddih]

first of all, make sure the email account you are using is safe

now ...
the login emails call you by your permanent unchangeable Steam account/login/user name. they do not use your persona/community name, which is changeable by yourself.

check if the emails are even for the account that you are actually using. not rarely people have multiple accounts on the same email (which is possible) and the login attempts are for an other remnant account.

as for cookies:
any credential change invalidates all sessions and with that all possible cookies storing session information. if there was a valid login cookie being used, there would be no Steam Guard email or mobile notification.