Scam using friends list?

[Caffeinated Quill]

I got a message from someone on my friends list who I know IRL, but the message was definitely a scam. "Sup, gift steam 10$ balance for you, just claim it". He most definitely did not send it BUT he still has complete access to his steam. He hurriedly changed his password. I know some games can manipulate messaging you like it was your friend (Pony island does this well) but is that possible for scammers?
I suppose I'm asking 1) has anyone else gotten this 2) Is his and my account safe (I didn't click any links) and 3) is it possible to get messages like that that are fake?
Thanks in advance.

[Aachen]

Absolutely a scam. Their credentials likely got phished and thereby are now hijacked.

[Pscht]

Tell your friend this:

YOUR ACCOUNT IS COMPROMISED

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party trade sites or clicking suspicious links.

[Caffeinated Quill]

Publicado originalmente por Aachen:

Absolutely a scam. Their credentials likely got phished and thereby are now hijacked.

Does being hijacked mean their account is compromised? He changed his password when i showed him.

[Cathulhu]

Just changing the password is not enough.

[Caffeinated Quill]

Publicado originalmente por Pscht:

Tell your friend this:

YOUR ACCOUNT IS COMPROMISED

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party trade sites or clicking suspicious links.

Okay thank you I'll relay this to him

[Caffeinated Quill]

Publicado originalmente por Cathulhu:

Just changing the password is not enough.

Thank you for letting me know. I'll tell him

[Aachen]

Publicado originalmente por Caffeinated Quill:

Does being hijacked mean their account is compromised? He changed his password when i showed him.

Correct. And as already posted, a pw change isn’t sufficient to prevent access by the hijacker. Pscht covered further steps.

[Caffeinated Quill]

Publicado originalmente por Aachen:

Publicado originalmente por Caffeinated Quill:

Does being hijacked mean their account is compromised? He changed his password when i showed him.

Correct. And as already posted, a pw change isn’t sufficient to prevent access by the hijacker. Pscht covered further steps.

Yeah you all are so quick ha ha. Thank you all so much! He's getting right on it.

[Pscht]

Publicado originalmente por Caffeinated Quill:

Yeah you all are so quick ha ha.

We see this multiple times every single day.

[Caffeinated Quill]

Publicado originalmente por Pscht:

Publicado originalmente por Caffeinated Quill:

Yeah you all are so quick ha ha.

We see this multiple times every single day.

Needless and unfortunate =( But truly thank you for all the links and set up guide. I'm saving them for just in case lol

[76561199281265327]

by the way these users act in other threads i would not trust any of them with anything in regards to links

[Caffeinated Quill]

Publicado originalmente por New Login for Fallout76:

by the way these users act in other threads i would not trust any of them with anything in regards to links

It is always wise to fact check, yes.

[J4MESOX4D]

These are chain scams where a user is compromised then their account starts sending out botted scam messages to their friends list and anyone that falls for that then has their friends list targeted.

Even if its your friend, report the account as compromised - at least that way it can be locked before it anything worse happens with it.

[ShelLuser]

And in addition to all the good advice given above you may also want to warn your friend that they should not use their Steam account so casually on websites which aren't Steam.

Because that is most likely the way how all of this started: people log onto a website which isn't Steam while thinking that they log back onto Steam in order to log onto that website. In reality though they're gibing away their username, password and possibly also the security code.

The problem here is simple: a site doesn't even have to be shady. Some websites even rotate between using a real Steam logon and a fake one. So that is definitely something to look out for.