Steam account hacked with no signs or emails whatsoever

[SkyLLer]

Today I woke up just to see my friend texted me and sent a screenshot of my account promoting pishing links, my email did NOT receive any steam guard code or whatsoever, no new location alert, I was still able to access to my account somehow. And Steam is so good that I can't even delete the links from my friends dms. 💯 Can someone just tell me what in the absolute universe is going on

[Callahan420]

Secure the account

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party skin trading/gambling sites or clicking suspicious links.

[magicISO Sweden]

You must be logged out of all accounts to start the account recovery process.

You don't need access to the email, phone or password currently tied to the hijacked/hacked account for this to work. Just pick the "I do not have access..." or a similar option when asked.

And to help you sign-in: https://help.steampowered.com/en/wizard/HelpWithLogin

A step by step guide to the recovery process:
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

[Muppet among Puppets]

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

[Kargor]

Muppet among Puppets eredeti hozzászólása:

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

Not necessarily.

My theory -- and, unfortunately, that's all it is since I haven't found descriptions of what they actually do -- is that hijackers don't even care about your credentials. They pick up the login-key, which is the item that the Steam client or bots use so they don't have to do the whole credentials/2FA every time the user runs it.

When was the last time your client has asked you for an actual login?

[Muppet among Puppets]

Kargor eredeti hozzászólása:

Muppet among Puppets eredeti hozzászólása:

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

Not necessarily.

My theory -- and, unfortunately, that's all it is since I haven't found descriptions of what they actually do -- is that hijackers don't even care about your credentials. They pick up the login-key, which is the item that the Steam client or bots use so they don't have to do the whole credentials/2FA every time the user runs it.

When was the last time your client has asked you for an actual login?

That would require "infection" of the device.

[Kargor]

Muppet among Puppets eredeti hozzászólása:

Kargor eredeti hozzászólása:

Not necessarily.

My theory -- and, unfortunately, that's all it is since I haven't found descriptions of what they actually do -- is that hijackers don't even care about your credentials. They pick up the login-key, which is the item that the Steam client or bots use so they don't have to do the whole credentials/2FA every time the user runs it.

When was the last time your client has asked you for an actual login?

That would require "infection" of the device.

Not if you use a fake login page.

While I only work with clients, and I have 0 experience with modern webstuff, I'm 99% confident that the web-logins pretty much work the same -- so, there's going to be a cookie with the login key. Maybe, but that's going into web-territory that I know nothing about, they can just run some Javascript that loads the actual loginpage from steam while still being able to access the cookies. Else, they'd just have to duplicate the Javascript that Steam uses for the login page.

Again, I keep reading about account hijacks -- and I find it much easier to assume that your average Counterstrike-player is directed to a "skin"-site using a fake login page that grabs the login key, as opposed to an all-out assault where they need access to EMail or the authenticator. I find it much simpler to assume the hijackers use the easy route.

[SkyLLer]

Callahan420 eredeti hozzászólása:

Secure the account

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party skin trading/gambling sites or clicking suspicious links.

Hello, I don't have any malware on my pc, I change dmy password so that might sign out all the devices. Can't revoke API keys cus I don't pay 5$ on steam and no I don't use any gambling sites, I barely play steam games even.

[SkyLLer]

Muppet among Puppets eredeti hozzászólása:

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

Email auth is enabled by default, I didn't changed anything about the security section of my Steam account, no steamguard code or new location alert was sent to my email at all.

Appreciate the replies btw, sorry if I suck like a jerk when I posted this cus I was really frustrated lmao

[SkyLLer]

Kargor eredeti hozzászólása:

Muppet among Puppets eredeti hozzászólása:

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

Not necessarily.

My theory -- and, unfortunately, that's all it is since I haven't found descriptions of what they actually do -- is that hijackers don't even care about your credentials. They pick up the login-key, which is the item that the Steam client or bots use so they don't have to do the whole credentials/2FA every time the user runs it.

When was the last time your client has asked you for an actual login?

Like a few (3/4) weeks back before?
I don't know what qualifies as an "actual login" but during that time period is when steam still sends me to code in my email and asks me to fill in the codes, ever since then I have never tried logging into my account. I have enabled steamguard mobile ever since this post was made. Never logged into any fake login page, never used third party sites, never used gambling sites (I don't play csgo or trade items) Device is fully secured and my email has 2fa aswell that requires me to allow access through my phone

[Muppet among Puppets]

SkyLLer eredeti hozzászólása:

Muppet among Puppets eredeti hozzászólása:

If you had email auth enabled, you should have gotten a code in email. Otherwise your email is accessed.

Email auth is enabled by default, I didn't changed anything about the security section of my Steam account, no steamguard code or new location alert was sent to my email at all.

Each login attempt creates an email then. If you did not find any, it could indicate that the email account is in trouble too.
And if the passwords are different, a device you used for these accounts might be the leak.