Look out for old friends sending you survey links, it's a phish!

[Thunder Child]

My steam ticket is taking forever for someone to look at it and I want to do something while I'm waiting. Basically, an old high school friend sent me a link to do a survey thing that needed me to link my steam account. Well it turns out it recorded my login credentials.

That was maybe a month ago, and today a co-worker sent me a text saying they were asked to do the EXACT same survey FROM ME. Looks like all of my friends who were online got targeted and their communication was 'blocked' I assume so that I wouldn't get alerts from the messages.
One of my old old co-workers seems to have actually clicked the link, I tried contacting them but they haven't responded. I mentioned them in my steam ticket so I'm hoping support/security can help lock down their account.

It was JUST a link either, it's either a person or chat GPT and they just start off with a "hi, are you free?" and then butter you up to do a quick survey to support their logo or something.

UGH, why am I posted to the forums about this! Where is the steam security phone number to call when you're in panic mode.
I changed my password and I guess that's all I can do, what's annoying is that I HAVE 2FA setup and it seems like the bad actor was able to get around that somehow. Maybe the 2FA sessions don't time out or something?

[Unn4m3d (♥AUT♥)]

It wasnt your "high school friend", it was whoever hijacked his account. It's a Scam as old as time and instances of this can be found everywhere around these forums.

There was no need for another PSA Thread.

Instead of panicking you can just follow these Steps:

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

And stop logging in on sketchy sites.

[Thunder Child]

Unn4m3d (♥AUT♥) a écrit :

3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage

This was a good call out, I actually saw a device listed on my steam guard that said it was authorized like 40 minutes ago for Chrome. But I use Firefox. I just de authorized all devices from the steam accounts page.

[Unn4m3d (♥AUT♥)]

Thunder Child a écrit :

Unn4m3d (♥AUT♥) a écrit :

3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage

This was a good call out, I actually saw a device listed on my steam guard that said it was authorized like 40 minutes ago for Chrome. But I use Firefox. I just de authorized all devices from the steam accounts page.

You should follow all the steps. In order.

[Thunder Child]

Yeah yeah I did, just thought it worth noting that step I noticed was a particularly good call out.

[cSg|mc-Hotsauce]

Report your friends account as being compromised through their profile page.

[Thunder Child]

It no longer exists. I don't know if steam deleted or disabled it, the phisher, or my friend.

[cSg|mc-Hotsauce]

Thunder Child a écrit :

It no longer exists. I don't know if steam deleted or disabled it, the phisher, or my friend.

9/10, the URL was changed to prevent people from going back to report them after the fact.

[PCPlayerZero]

Your nick name should be completely different from your e-mail. I know this is obvious, but probably there are people that don't pay attention to that.

[Dr.Shadowds 🐉]

As long you did all steps above you're golden. For not able to find your friend profile again the scammer just defriended you, and changed the profile custom URL to try prevent anyone from finding it, and try to repeat scam with others on the firend list.

All you can do if you know the person that own the account from other places like discord, or etc, just shoot them a message that their account been stolen, and they need to go contact steam support that all you can do.

[Bibo1]

The people who fall for these scams don't read PSAs.
The intention may be well meant but it's a waste of time.
Stickies exist but are generally ignored.