Hack Forums
[Warning] Steam phishing attacks exploiting look-alike domain names! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [Warning] Steam phishing attacks exploiting look-alike domain names! (/showthread.php?tid=4428608)

Steam phishing attacks exploiting look-alike domain names! - Meow - Sep 2, 2014

Hey guys so this is my first warning thread in this section.
Sorry if this has already been posted and sorry for any grammar mistakes,I'm writing this at 4 am.


So recently there was a lot of phishing attacks on Steam members (Mostly CS:GO/TF2 players) where they want to "trade" one of yours shitty items for awesome one.
They just randomly add you and ask you if you want to trade and they are usually low steam level.

Spoiler (Click to View)

As you can see,it looks like steam URL but if you look closely you can see it has diffrent 2-3 letters from official steam site.
Usually people don't read URL's because if it looks similar it probably is steam site.

http://steamcommunity.com/

There have been 100+ steam phisting sites and here are some of popular ones.

Spoiler (Click to View)

After you click on "trade" link it will direct you to his awesome "steam profile" where he puts some rare items as Item Showcases so he can get your attention.
His account is usually high level with a lot of "reputation" from other steam "members"

Spoiler (Click to View)

And from that point you need to login to your steam profile so you could complete "trade" with him
BUT you need to download special "tool" because you are coming from new browser or something like that..

Spoiler (Click to View)

And from that point he will most likely steal your password and transfer your items to his account and it will keep sending friend requests to other users from YOUR account.

If you think your account might be compromised or stolen be sure to read these 2 links.

https://support.steampowered.com/kb_article.php?ref=2347-QDFN-4366&l=english
*How to recover steam account*

http://forums.backpack.tf/index.php?/topic/1206-guide-to-recovering-hijacked-items/
*How to recover steam items*


If you want to learn more on these phishing attacks be sure to read some of links below.

http://www.polygon.com/2014/6/25/5843198/steam-phishing-scheme-steam-guard

http://www.pcgamer.com/2014/06/26/updated-steam-phishing-scam-automates-ssfn-upload/

https://blog.malwarebytes.org/fraud-scam/2014/04/phishers-bypass-steam-guard-protection/

http://steamcommunity.com/groups/tf2outpost/discussions/0/864971658468769910/


Stay safe guys. 🤝

* - _SaM_ - Sep 3, 2014

Thanks! I've had friends fall victim to this, it's a real shame

* - PatientZero - Sep 9, 2014

Hmmm,
SteamGuard.exe seems legit, I guess this is so they can RAT you or steal other passwords so they can take control of your whole steam account?

* - Remix™ - Sep 9, 2014

Damn man, people go in depth about this shit. It looks so legit too...always read URL's and if you don't think its 100% legit, don't do it

* - DierDeer - Sep 25, 2014

Link me to any fishing sites you find, I have successfully ddos offline 50 steam phishing websites and counting. PM me any and all you find, I will single handed take down the scammers.

* - Beardsteak - Sep 25, 2014

(Sep 25, 2014 12:03 PM)DierDeer Wrote:  Link me to any fishing sites you find, I have successfully ddos offline 50 steam phishing websites and counting. PM me any and all you find, I will single handed take down the scammers.
Yeah cause ddosing their websites is gonna take them down for sure, lmao. a 10 minute ddos on their website wont stop shit, it'll just go straight back online. You're stupid for doing that shit, your not stopping shit. Why would you brag about ddosing 1$ phishing websites?
Anyone can go buy a booter now, and do the exact same shit as you.

* - Aura - Sep 27, 2014

Meow, you know that everyone make a new thread about it every month, right ? That attack with SteamGuard.exe have been going on for MONTHS, if not a whole year now, lol.