Items stolen, steam account compromised, mysterious hacker

[degr33]

Recently I noticed I had money pending on steam wallet, checked to see how it was possible since I was pretty sure I hadn't listed anything and then found that someone else listed and sold a ton of in-game items under my account.
Now here's the interesting part - I still have access to my account, and my Steam Guard Authenticator didn't flare up when these items were put on sale. Also, checking my login history I haven't found anything out of the ordinary. So does anyone know how the in the hell can someone sell my items, bypassing Steam Guard, without logging in, and if they did somehow log-in, why would they not change my password? Are they just being nice and kind of just letting me know they have access to my account by selling off some items hah?

[Fion]

This happened to me today to. No guards went off. THEY just did everything in a three day span starting on the 25th WHILE I am playing games. How on earth can someone control your account while you are using it? While I was signed in and looking at my profile I went to the washroom and in 5 minutes I cam back to my profile gone. Everything deleted. Over 130 inventory items gone through that 3 day period. Nothing warned me. Really don't feel safe on this app right now if people can do this now.

[Aluvard]

You were phished or you've malware on your PC.

https://help.steampowered.com/en/faqs/view/06B0-26E6-2CF8-254C#stolen

[degr33]

Oh it's definitely malware, stupid old me trusted the wrong files hah, but I would hope some tech savvy individual would comment on what kind is it exactly, I've been monitoring my processes closely and have not noticed anything out of the ordinary, probably just going to do a clean system install to be safe, I have this inkling that the dirty villain sent himself my browser cookies and just parsed the info from there, or the malware is so high-level its embedded itself into my system files and I'm being watched right now, which would be quite ironic, but i doubt I'm the prime target for the communist party. It's just interesting how invisible the rat has been with his activity. If there's something concrete I could find in Event Viewer, let me know.

[Fion]

I’m doing a full factory reset install by also bringing it in to a professional. And I’m using my phone for now while my computer has been severed from the internet. Mine was due to malware and they accessed my email probably from a remote control thing then went straight for steam inventory items by going into my steam account. Seriously why is steam inventory so sought after? Many items are just a couple cents and they are risking years in jail for some csgo skins. Utter insanity you would risk your future for something so stupid. But regardless if there is also a key logger then the computer has to be brought in to a professional so you don’t screw anything up. They can steal alll your passwords and see what’s on your screen. So much more stuff unsaid.
The sad part is Steam is doing nothing to Thwart the people I reported that got many of my items. Simply said it’s my responsibility and they locked my request put in. The hijacker’s even gifted items to a few people and Steam support won’t even give those back. And they were gifted games and community beta stuff. It’s crazy.

[Nx Machina]

Accounts are PHISHED not hacked.

You gave the hijacker all your account details.

The account name, the password and the KEY to the door, the Steam Guard Mobile code, or scanning the QR code or authorising via fingerprint giving them access to the account.

How? by either logging into a known scam site or sites, tailored malware on your PC, the vote for my team scam, you have a pending ban scam on Discord, free knife click the link etc.

How does Steam (a program) know it is not you when all the account details are correct? It doesn't, therefore any action taken on your account is seen as you doing said actions.

The alternative is not plausible:

1) Someone would have to "GUESS" your account name from "millions of possible combinations".

2) Next they would have to "GUESS" your password from "millions of possible combinations" and then match it to your account name with "millions of possible combinations".

3) And finally they would have to "GUESS" the Steam Guard Mobile code "which changes every 30 seconds" to match both your account name and password to then have access your account.

Or please explain how in 19+ years I have never lost access to my account and that includes before Steam Guard Email and Steam Guard Mobile existed.

[Fion]

I think either an executable I downloaded recently had keylogger in the installation file along with some other files like remote access stuff when I saw it installing something and it failed to install. At least that’s what it claimed but I think it installed all that crap which lead to my predicament. The only other thing is when I was signing up for Stalcraft it leads to an off branch site to connect your steam account to their website. And I without question signed into to the popped up browser showing steam. Or was it steam? And maybe that’s why I got phished and hijacked. I have had my Steam account since I was like 13 or 14 years old and now I’m 32. This is the first ever time it’s happened to me cause usually I’m pretty darn good security protected wise.

Thing is I’ve never had the steam guard mobile code. Or used anything on my phone regarding Steam. And two factor was turned off. Only email identification was on. Never used it until now to extra protect my account.