unauthorized market transactions

[clix_clix]

This morning I noticed that my items were listed and sold/buy on the marketplace without my permission. my account was protected with “steam guard”. I saw transaction messages in my mailbox then checked the steam logs I realized that my account was logged in from Japan. I immediately removed the unsold items from the list, but unfortunately about 100 items were sold very cheaply. I don't know who logged into my account. I don't think the items sold without my approval can be bought back to my account. what I want to ask is, although my account is protected with steam guard, how can someone access my account and make transactions? this is the first time something like this has happened to me. how did another one access my account? can this happen again?

[Yujah]

Oprindeligt skrevet af clix_clix:

can this happen again?

It can and in fact will unless you kick out the hijacker from your account as per the 6 steps from e.g. the below linked post by Wolf Knight.

https://steamcommunity.com/discussions/forum/1/4629230582747975341/#c4629230582747975678

Because that's what's happening: someone is on your account, either through local session-stealing malware (rare) or you at some point having fallen for some phishing attack (third-party skins trading sites tend to all be scams; "vote for my team", etc., etc.). In both cases Steam believes it is you, in former due to as far it knows the transactions being initiated by your own, already logged in client/browser, in latter due to them using a phished set of credentials including guard code that you gave them potentially weeks or months ago already and them having been logged in ever since (and please note that the entire idea of being successfully phished is that you wouldn't have been aware of it)

Anyways; do as per the steps from the linked post.

[Yujah]

By the way, let me immediately add that that first option ("local session-stealing malware") might be in the process of becoming less rare. Heard some browser-based such malware was in fact doing the rounds currently, and also f.e. recently we had someone who even after doing all those mentioned steps, got infected immediately again when logging in again.

In that case, and if malware scanners ain't finding it, resetting browser profiles or even full clean reinstall of Windows can be in order.