My account was "Hijacked" but there has to be something more to it. Steam won't cancel the transaction.

[Jamons -]

So after waiting 24 hours for my funds to be released from selling a low tier knife for 205 dollars, I finally got the money. Immediately after, i got an email from steam saying "thanks for your purchase of a Inscribed Rearms Dota 2 card. This normally sells for $0.03, yet it was purchased for 205 dollars from my account.

I have authenticator, steam guard, all the works and it is hooked up to my phone. When I contacted steam they replied with the following message.

"

Hello there,

Account hijackers have several common methods of attack, most of which rely upon misinformation or deception.

With that said, if activity occurred on your account you do not recognize, it may mean your account or computer has been compromised.

Someone may have gained access to your Steam account through spoofing, phishing, or malware.

As an immediate first step, you should take some action to secure your Steam account from further access. Our article on account security recommendations is a good start toward securing your Steam account.

If you suspect your computer is infected with malware, we have some tips for removing malware from your computer here. It may be a good idea to contact a local computer security expert if you're having trouble removing this malware.

Additionally, all Community Market transactions are final and cannot be reversed or refunded. When an item is purchased from the Community Market, the cost is sent from the buyer's Steam wallet to the seller's. Reversing these purchases would mean we have to take funds out of the seller's wallet, creating confusion and possible purchasing issues across Steam.

I understand the eagerness on this matter, however, I'm sorry we can't be of more help with this, but we don't reverse or refund Community Market purchases and sales.

For future reference, confirmation is only required when listing an item on the market. However, items that typically sell for under $1.00 USD will no longer require confirmation when the list price is reasonably within the median price, but confirmation will still be required once many of those cheaper items are listed. Confirmation will still be required on all rare and valuable items.

Steam Support

Ken"

Is it possible that Steam itself is compromised and they have rouge employees? It is only $200 so I am very confused why they would take the risk. But now the worthless card is trade locked for 7 days. What is the point of it being locked if someone can just "hijack" your account and you can't get a refund.

I sold my knife to purchase the new BMX Streets. It essentially seems that they are stealing both from me as well as the developer of BMX Streets.

[alphaqrealgood]

Yeah this is ridiculous i lost $81 from my steam wallet in what world can a company lose your money and say your bad

[Ted]

Yep, I also got hijacked. I lost about 20 CS skins. Total value I guess was approximately €10 lol. Still annoying as fk.

[zandy]

İlk olarak scremin tarafından gönderildi:

Same thing happened to me, woke up with an email saying that I bought a Dota2 item for 30$, id costs lass than 1$ at the marked.

I'm waiting steam support to reply

same. hacker bought a $0.04 item for $28. Steam was no help on the refund, awful fraud detection customer support

[ShengDiYaGe]

Same. The hacker selled, almost emptied my inventory and bought some Dota 2 accessories. I think I never used this community market, never done a single transaction. I never have money in steam wallet. So actually my wallet balance get from 0 to ¥0.32, as the last batch things(my trading card or those things) the hacker selled haven't been used for purchasing Dota 2 ♥♥♥♥ yet.
So far only my steam account is hacked. I used my malware software and haven't found any malware. My steam binded email looks fine, with a lot of steam community market transaction mails and "steam point award given to some account"mails. I don't think I got phished.

The top priority thing is: What's the cause of being hacked?
1. Steam data breach?
2. Steam system FLAW? And Steam itself just allow it?
3. Steam employee be the hacker itself?
4. Maleware? Only need to worry about the ssfn file, or something more severe?
(please choose the situation you are facing: )
4.1 Only steam account compromised.
4.2 Other than steam account, any other thing compromised.
5. VPN? Just some guess. I just changed my VPN not long ago and I got hijacked. And from the "Steam Support - Recent Purchases" page, I can see the currency types the hacker used are from all over the world. Can the cause be malware on VPN proxies?

Can any savvy tech locate where this problem come from? Or just mark your best guess with 1. 2. 3. 4.1 4.2 5. ?
By the way, it seems this hijacked thing have been there for a LONG TIME. I've seen post from last year. And Steam just play blind to it.

[RunForRest]

Im not an expert nor really knowledgeable, but this is what i found researching this when this happened to me. (someone got access to my system through malware)
Make a deep scan with malwarebytes for rootkits - that takes abit (took 9 hours to scan my 250GB SSD drive), also scan the rest of ur drives, use 2 different scanners, malwarebytes and windows defender are a very good start)
Also checkout Process Explorer and Autoruns (use the virustotal function). Paying attention to open connections and ports and how much data certain processes push/pull through ur internet connection can also help identifying suspicious things happening on ur system (Wyreshark helps with this but also not to bad to learn abit about netstat command).
Adviseable to format evertyhing and reset the system to a clean state (unfortunately short-term no option for me but i will work on a long term solution involving switching to linux for singleplayer games (Microsoft scumbags cant be trusted anymore since a looong time but Win11 is where i draw the line) and a second non-gaming system)
When u are certain ur system is clean make new, SAVE passwords (15+ long, big and small random letters, numbers and special signs or use a save password manager) for everything.
In general:
Research how to stop Windows submitting all kinds of data
Dont have anything irl/work related on ur gaming system
Dont crosslink every gaming platform.
Dont link bank accounts (if at all temporary)
Dont use (a)social media
Use different email adresses for different things

GL

[ShengDiYaGe]

İlk olarak RunForRest tarafından gönderildi:

Im not an expert nor really knowledgeable, but this is what i found researching this when this happened to me. (someone got access to my system through malware)
Make a deep scan with malwarebytes for rootkits - that takes abit (took 9 hours to scan my 250GB SSD drive), also scan the rest of ur drives, use 2 different scanners, malwarebytes and windows defender are a very good start)
Also checkout Process Explorer and Autoruns (use the virustotal function). Paying attention to open connections and ports and how much data certain processes push/pull through ur internet connection can also help identifying suspicious things happening on ur system (Wyreshark helps with this but also not to bad to learn abit about netstat command).
Adviseable to format evertyhing and reset the system to a clean state (unfortunately short-term no option for me but i will work on a long term solution involving switching to linux for singleplayer games (Microsoft scumbags cant be trusted anymore since a looong time but Win11 is where i draw the line) and a second non-gaming system)
When u are certain ur system is clean make new, SAVE passwords (15+ long, big and small random letters, numbers and special signs or use a save password manager) for everything.
In general:
Research how to stop Windows submitting all kinds of data
Dont have anything irl/work related on ur gaming system
Dont crosslink every gaming platform.
Dont link bank accounts (if at all temporary)
Dont use (a)social media
Use different email adresses for different things

GL

Thanks a lot. Will try more scanners. What's the malware you found? The file name, size, the properties that may help locate the virus?

[RunForRest]

I got 2 new screens shortly before and was looking for system monitoring tools with nice design. Discovered rainmeter, found a skin (glass shards) that looked like it had what i was looking for - the file that was installed through rainmeter wasnt an exe itself but installed 2 exe files. Malwarebytes idendified those 2 files. The attacker had access to my system 2 days after i installed that skin - sold my steam inventory and send steam gift messages to all my friend contacts in discord. Discord autoblocked my account, unfortunately Steam wasnt that smart. I now have Steam Guard installed on my phone.
Part from the malware report:

Floxif.Virus.FileInfector.DDS, C:\USERS\myUsername\DOCUMENTS\RAINMETER\SKINS\GLASS SHARDS\@RESOURCES\ADDONS\RAINFILE\RAINFILE.EXE, Keine Aktion durch Benutzer, 1000002, 0, 1.0.89171, 8C035E4CF8647BA70C7EF551, dds, 02999284, 7B7DCA8CCFB9D4AAA1F482C4A82FBB0D, AF6DA297A28D23C4D9837E63904C7ED8B28672E0A82DA0E6AA14374FCADE7873
Malware.Sandbox.48, C:\USERS\myUsername\DOCUMENTS\RAINMETER\SKINS\GLASS SHARDS\@RESOURCES\ADDONS\SLEEPME.EXE, Keine Aktion durch Benutzer, 48, 0, 1.0.89171, 48, dds, 02999284, BF440A4B68157D28325F885FC6C09A3C, 6377051A29B8CAFD4924B6976D40C2C48DF6C7DA0A5E32022392733523ACD66C

I reported the website to a google or microsoft service cant remember

[ShengDiYaGe]

İlk olarak RunForRest tarafından gönderildi:

I got 2 new screens shortly before and was looking for system monitoring tools with nice design. Discovered rainmeter, found a skin (glass shards) that looked like it had what i was looking for - the file that was installed through rainmeter wasnt an exe itself but installed 2 exe files. Malwarebytes idendified those 2 files. The attacker had access to my system 2 days after i installed that skin - sold my steam inventory and send steam gift messages to all my friend contacts in discord. Discord autoblocked my account, unfortunately Steam wasnt that smart. I now have Steam Guard installed on my phone.
Part from the malware report:

Floxif.Virus.FileInfector.DDS, C:\USERS\myUsername\DOCUMENTS\RAINMETER\SKINS\GLASS SHARDS\@RESOURCES\ADDONS\RAINFILE\RAINFILE.EXE, Keine Aktion durch Benutzer, 1000002, 0, 1.0.89171, 8C035E4CF8647BA70C7EF551, dds, 02999284, 7B7DCA8CCFB9D4AAA1F482C4A82FBB0D, AF6DA297A28D23C4D9837E63904C7ED8B28672E0A82DA0E6AA14374FCADE7873
Malware.Sandbox.48, C:\USERS\myUsername\DOCUMENTS\RAINMETER\SKINS\GLASS SHARDS\@RESOURCES\ADDONS\SLEEPME.EXE, Keine Aktion durch Benutzer, 48, 0, 1.0.89171, 48, dds, 02999284, BF440A4B68157D28325F885FC6C09A3C, 6377051A29B8CAFD4924B6976D40C2C48DF6C7DA0A5E32022392733523ACD66C

I reported the website to a google or microsoft service cant remember

Thanks. I think I will do more scans.

[Kratos]

So I have got the same issue and they even got to my discord account and thank god I didn't have my credit card details on my account but I got an antivirus now and changed all my passwords should I be worried about anything else??

[RunForRest]

As long as u r not very very sure ur system is clean password resets dont do nothing since the intruder can still see all that !

[twitch.tv/NLbawz]

I had the same yesterday. Its very obviously affecting numerous users and clearly a way to scam people out of their wallet money. Not sure how they got into my stuff either as I also never got a Steam Guard noti.
Its stupid they dont issue refunds for this, it literally lets them get away with it.

[Periquitinha Rosinha]

Just happened to me. Samo story, no virus, no api, no steam guard notifications. Never logged in suspicius sites, never traded, all my steam wallet is gone and all my cheap itens were sold. 300+ Transactions in less than 1 minut, nothing to block that even beeing obvius that it was a bot.

[تابعة لماريا Kannubis]

İlk olarak Periquitinha Rosinha tarafından gönderildi:

Just happened to me. Samo story, no virus, no api, no steam guard notifications. Never logged in suspicius sites, never traded, all my steam wallet is gone and all my cheap itens were sold. 300+ Transactions in less than 1 minut, nothing to block that even beeing obvius that it was a bot.

im sorry 4 u .

[gremlios]

Just happened to be someone bought a useless .15 cent dota item for 200 dollars from my steam wallet.

[تابعة لماريا Kannubis]

Triste saber que esto sigue pasando, a diario sigo las notificaciones, y me entristece ser usuario de una empresa; que no cuida ni quiere a sus usuarios.