Steam Points Traffic, Stealer, Hacker

[MaverickC45]

A couple of weeks ago I logged into my email account and saw that all my steam points had been sent to a user. I never did such a thing, nor did anyone log into my Steam account, perhaps with some kind of security hole the hacker took advantage of that

When looking at the user's profile you can see that he has millions of points. I assume that they are all stolen in some way. I made the corresponding report and recovered my points by going back to create a new password.

However the user (who has not made any contribution to the community, nor any purchase on steam) continues to steal points.

https://ibb.co/Y3CCHL4

[walker]

ok

[cSg|mc-Hotsauce]

Secure your account. All the steps, in order...

Scan for malware. https://www.malwarebytes.com/ or with whatever

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key (this should be empty) https://steamcommunity.com/dev/apikey

Report the other account through their profile page.

Next time, change/reset your password within 2 weeks of when the awards were given out to revoke them all, within that 2 week period.

[MaverickC45]

Originally posted by cSg|mc-Hotsauce:

Secure your account. All the steps, in order...

Scan for malware. https://www.malwarebytes.com/ or with whatever

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key (this should be empty) https://steamcommunity.com/dev/apikey

Report the other account through their profile page.

Next time, change/reset your password within 2 weeks of when the awards were given out to revoke them all, within that 2 week period.

:nkCool:

My account is safe (I never use third party software, All my passwords are written on paper), I've checked my steam account logins and there's nothing suspicious. I didn't even have internet access when the theft happened.

Also, there are thousands of users who have been robbed and the user is still not banned (maybe he's not the culprit but he's definitely involved in some way) he hasn't logged in for months. That seems suspicious to me.

[cSg|mc-Hotsauce]

Originally posted by MaverickC45:

My account is safe...

For someone to hijack it and send all your points to another account, it most definitely is not safe.

[MaverickC45]

Originally posted by cSg|mc-Hotsauce:

Originally posted by MaverickC45:

My account is safe...

For someone to hijack it and send all your points to another account, it most definitely is not safe.

:nkCool:

This means that thousands of users think they are safe but are not, even with SteamGuard enabled.

How is it possible for a hacker to log in from another country if Steam Guard security is enabled?

What is SteamGuard for? You are supposed to accept each new access through the application

[Maria]

Look up session hijack and bloody stealer malware.

tl;dr steam has done their best to help secure your account, but they can only do so much. In the end, users are the weakest link.

[MaverickC45]

Originally posted by Maria:

Look up session hijack and bloody stealer malware.

tl;dr steam has done their best to help secure your account, but they can only do so much. In the end, users are the weakest link.

It seems you don't know anything and Y don't understand, the hacker didn't use my computer or phone, he logged in from a new computer in another country and SteamGuard didn't do its job

[RPG Gamer Man]

Originally posted by MaverickC45:

Originally posted by cSg|mc-Hotsauce:

Secure your account. All the steps, in order...

Scan for malware. https://www.malwarebytes.com/ or with whatever

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key (this should be empty) https://steamcommunity.com/dev/apikey

Report the other account through their profile page.

Next time, change/reset your password within 2 weeks of when the awards were given out to revoke them all, within that 2 week period.

:nkCool:

My account is safe (I never use third party software, All my passwords are written on paper), I've checked my steam account logins and there's nothing suspicious. I didn't even have internet access when the theft happened.

Also, there are thousands of users who have been robbed and the user is still not banned (maybe he's not the culprit but he's definitely involved in some way) he hasn't logged in for months. That seems suspicious to me.

That is what everyone says until they scan and find something. Always do this or your account is up for grabs. But it is your choice OP. Leave your account unsecure, or run the above and make sure it is safe.

[MaverickC45]

Originally posted by RPG Gamer Man:

Originally posted by MaverickC45:

My account is safe (I never use third party software, All my passwords are written on paper), I've checked my steam account logins and there's nothing suspicious. I didn't even have internet access when the theft happened.

Also, there are thousands of users who have been robbed and the user is still not banned (maybe he's not the culprit but he's definitely involved in some way) he hasn't logged in for months. That seems suspicious to me.

That is what everyone says until they scan and find something. Always do this or your account is up for grabs. But it is your choice OP. Leave your account unsecure, or run the above and make sure it is safe.

I have a better antivirus than malwarebytes. I update it constantly.

I did the research and there was an access on Nov 25 from another computer in another country, but Steamguard never notified me and I didn't even receive an email notifying me about it.

Anyway, I formatted all my devices and changed all my passwords. But this issue is not about me. It's about the user who is stealing millions of points and steam does nothing about it and it doesn't seem suspicious to them.


https://ibb.co/Y3CCHL4

[cSg|mc-Hotsauce]

You should delete the profile link. It can be viewed as harassment.

[cSg|mc-Hotsauce]

The screenshot also shows the profile name (identifiable information) which can be considered harassment.

[Thiesen]

Originally posted by MaverickC45:

Originally posted by cSg|mc-Hotsauce:

For someone to hijack it and send all your points to another account, it most definitely is not safe.

:nkCool:

This means that thousands of users think they are safe but are not, even with SteamGuard enabled.

How is it possible for a hacker to log in from another country if Steam Guard security is enabled?

What is SteamGuard for? You are supposed to accept each new access through the application

Because you Most Likely sometimes in the past used a third parrty website to login with your Steam credentials... this website simply phished that Information....

[Knee]

Logging into 3rd party skin trading websites, questionable sites that pretend to be Steam, or any unofficial place that requires you to login with Steam tends to do that.

[Maria]

Originally posted by MaverickC45:

It seems you don't know anything and Y don't understand, the hacker didn't use my computer or phone, he logged in from a new computer in another country and SteamGuard didn't do its job

https://web.archive.org/web/20240702153131/https://forums.steamrep.com/pages/hijacking/

[Rex]

If you need help with Account Security or Recovery, please contact Steam Support.