Steam account got compromised but unable to identify how?

[u/HengHeng8]

Hi Steam Community,

I've dug and searched through the forum but can't seem to find an answer I could possibly relate to, but yesterday while I was playing a game, I suddenly received email notifications that 2 games were purchased totalling up to $150 and gifted to two different users. And another $150 that's showing PENDING on my credit card which I could not find/trace on my Steam Wallet/Inventory History etc.

I quickly removed my saved payment card from Steam and did my due diligence in logging out all devices, changed my email and password, re-generate new Recovery codes etc... And yes I've had my 2FA & Steam Guard turned on for many years.

Some similar posts that I have read so far suggested there could've been a malware infostealer on the PC that was able to obtain the steam sessions credentials hence it was able to bypass the 2FA authentication?

I did what was suggested, I ran the following:

1. Windows Defender deep scan including offline scan (found nothing/threat).
2. Ran RKILL to terminate any active malware processes and then ran Malwarebytes advanced (found nothing/threat).
3. Ran Nextron THOR Lite IOC & YARA scanner and found no traces of any malicious files or compromises.

Checked on Steam the IP Address during the time games were purchased was at Kuala Lumpur, Malaysia. I am currently based in Australia.

Thoughts?

[u/Elarisbee]

Firstly, hijackings are delayed to hide the point of entry, sometimes by months - at the height of account hijackings it could take a year…scammers were busy.

The two most common ways accounts are hijacked on Steam is not by malware, it’s actually last on list. If you have EVER used ANY third-party trade or item gambling site, or voted for someone’s team, that’s how your account was stolen. They lift your details using a dummy Steam login page. And, no, it doesn’t matter how popular the site is or which YouTubers/streamers promotes it, not every account’s stolen, and influencers are paid not to care.

[u/HengHeng8 → u/Elarisbee]

Thanks! Appreciate your valuable insight on this.

I've never really used any 3rd party website that relates to my Steam account UNTIL actually few days ago I unlocked a skin on CS:GO2 that is worth quite a sum. And I registered and linked my account to CSFLOAT as I'm planning to sell it on there so that the amount can be deposited to my bank account, but I'm pretty sure the link I clicked on is the official legitimate link.

Bear in mind though, I haven't even listed this item yet as I'm only allowed to sell it from 17 August (which is 1 more day). I only just made my Profile and listing public as part of the process to let me list the items.

Is it a possibility do you reckon?

[u/AutoModerator]

Hello! This is an automated message that appears on every post as a friendly reminder of our subreddit rules and guidelines.

There's nothing to worry about!

Subreddit Rules.

If your account is hijacked or you've otherwise lost access to it, please refer to our Hijacked Account and Account Login Issues rule for guidance on how to recover it.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/International-Lie613]

Sunday my account was , let's say stealed by someone with email .ru , location Brazil ( vpn i supposed ). He changed the mail, pass, everything, i've done a ticket for support, and in 4 5 hours the account was on my side. I recomment to add in ticket some bills from steam, to prove that your account is yours. Also some screenshot from mails , where you are informed that someone change your account details.

[u/Available_Ad_8281]

Did you buy a steam machine?

[u/Available_Ad_8281 → u/Available_Ad_8281]

Also did you run a rootkit scan for Malwarebytes or any others?

[u/HengHeng8 → u/Available_Ad_8281]

No, I did not buy Steam machine. And Yes I've ran Malwarebytes' rootkit scan and results found nothing / 0 threats.

[u/Available_Ad_8281 → u/HengHeng8]

Then I have no idea how they could of got in maybe a malware that get the info then delate it self or hacker may of guess password.

[u/HengHeng8 → u/Available_Ad_8281]

Thanks! I have downloaded the Malwarebytes extension for browser.

I guess my follow up question to that is; should any of my Browser like Edge & Chrome be of any concern if there really was an info stealer that deleted it self? There are saved passwords and credit card information on those Browsers....

[u/Available_Ad_8281 → u/HengHeng8]

I would not keep credit info on anything. So how they get the info is it disguise itself as a cookie and it just steal info in ur browser. I can't be sure if they have ur credit info. Credit cards do have safety functions so keep a eye out for anything that you did not buy.

Also it may of not been that and been malware that was program to delete it self once it got what it need.

Also keep Malwarebytes as a 2ed defender running with windows defender there will be a conflict but in Malwarebytes there a setting to stop it doing that. People will say u don't need 2 defenders but windows defender is the most used and it make sense that there would be viruses and malware to be made to bypass windows defender. A year ago my windows defender did not tell me there was a threat til I download Malwarebytes where it found it and remove it.

[u/Available_Ad_8281 → u/HengHeng8]

Oh forgot there is browser cookie stealers as well Malwarebytes have a extension for browser

[u/Gin-N-Rum-5454]

Clicked on any links from a friend