Steam Site Hit by Phish Scam

Matrix Games Forums

Forums Register Login Photo Gallery Member List Search Calendars FAQ

My Profile Inbox Address Book My Subscription My Forums Log Out

Steam Site Hit by Phish Scam

View related threads: (in this forum | in all forums)

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [General] >> General Discussion >> Steam Site Hit by Phish Scam

Page: [1]

Message

<< Older Topic Newer Topic >>

Steam Site Hit by Phish Scam - 4/20/2014 11:42:39 AM

Joe D.

Posts: 4004
Joined: 8/31/2005
From: Stratford, Connecticut
Status: offline

from Yahoo News

"A new phishing scam tries to trick gamers on the Steam online video game platform into divulging their passwords � and it does so by masquerading as Steam's own security measures and tricking users into disabling the Steam app's built-in protection ... Malwarebytes reports that scammers have crafted official-looking Steam login pages that prompt users to enter their usernames and passwords. These pages are just 'phishing' or using bait to trick users into compromising themselves.

"In the usual Steam sign-in process, users would then have to enter the emailed code generated by Steam Guard. However, the scam website then asks users to upload a file from the Steam folder on their computer called a SSFN file. This file is what authorizes your computer to Steam Guard; it essentially tells Steam Guard not to demand an emailed code.

"If you upload your SSFN file, the scammers can then use it, along with the phished usernames and passwords, to access your Steam account. Once inside, the scammers can drain the account's credit as well as its virtual items and trading cards that Steam users can collect and trade. However, the scammers can't buy more video games from Steam's online store, since that would require knowing your credit card information ..."

http://news.yahoo.com/steam-gaming-hit-phishing-scam-181655051.html

_____________________________

Stratford, Connecticut, U.S.A.

"The Angel of Okinawa"

Home of the Chance-Vought Corsair, F4U
The best fighter-bomber of World War II

Post #: 1

RE: Steam Site Hit by Phish Scam - 4/20/2014 12:51:26 PM

JiminyJickers

Posts: 290
Joined: 10/4/2011
From: New Zealand
Status: offline

Thanks for the warning. I would never upload a file from my PC as part as a login procedure, but it is good to be aware of this none the less.

(in reply to Joe D.)

Post #: 2

RE: Steam Site Hit by Phish Scam - 4/20/2014 2:09:05 PM

CGGrognard

Posts: 579
Joined: 10/3/2013
From: USA
Status: offline

Thanks for the information, especially the details of it's working.

_____________________________

"The supreme art of war is to subdue the enemy without fighting." - Sun Tzu

(in reply to JiminyJickers)

Post #: 3

RE: Steam Site Hit by Phish Scam - 4/20/2014 4:48:45 PM

gradenko2k

Posts: 935
Joined: 12/27/2010
Status: offline

So all you have to do is to hand-over your username and password to a total stranger? Man, these scams are getting subtler and subtler every day

(in reply to CGGrognard)

Post #: 4

RE: Steam Site Hit by Phish Scam - 4/20/2014 5:42:38 PM

Qwixt

Posts: 901
Joined: 6/19/2006
Status: offline

I kind of disagree with the title as the steam site has been hit with nothing. Most likely, users are getting directed to the fake site through email or other activities. Then the users fall for some amazing and overly complex wtf were you thinking trap. If these scammers actually managed to replace the steam pages with their stuff, then yes, steam site did get hit by the scam.

Otherwise, this is the same basic phish scheme used over and over, but with a twist due to the need to upload a file.

(in reply to gradenko2k)

Post #: 5

RE: Steam Site Hit by Phish Scam - 4/20/2014 7:38:24 PM

aaatoysandmore

Posts: 2854
Joined: 9/11/2013
Status: offline

Another thing I keep getting daily on my Steam account is asking me to verify my Email account, using the ole method for security purposes and bringing me excellent customer service. It does have a close this popup feature and every day that's exactly what I do. There is no reason for Steam to need to verify who I am unless I ask them to or report some scandal. I never type in my email address and immediately close this lil popup (looks like a banner across the screen) and have written to support to please stop sending me this crap, but they never respond (as per usual with Steam when you want support). Just an FYI in case you get this too. I'd contact Steam officials first before verifying anything you didn't setup to be verified like when you change computers or browsers or something like that and your Steam Account doesn't recognize that computer or browser.

(in reply to Qwixt)

Post #: 6