Jump to content
  • 0

WARNING -- Phishing/Hacking Attempts

Yamagata 1st MRB

Asked by Yamagata 1st MRB,

 Share

Question

Yamagata 1st MRB Presidential Poster

Yamagata 1st MRB

Posted
Posted (edited)

Hello All,

It looks like SSgt. Marchese's steam account has been compromised. If you receive a message "WTF Dude?" with a link to a "screen-pictures" site, DO NOT FOLLOW IT. You will download a virus, if not some sort of keylogger or malicious software. Steam community says it steals all your trade-able DLC and resends the virus to your friends list.

omithacked_zps9d32ca43.png

I can PM the URL if anyone feels like getting hacked and/or wants to debug it! :lol:

If you did download or follow the link, run a virus scan and change your steam password ASAP!

Being in IT has taught me to be wary of unknown links from others, and to NEVER download unknown files. When I saw the link, I immediately googled the site for legitimacy and the list of warnings and infection reports on the Steam Community threw up the red flag. Please be cautious and browse safely! If anyone has issues, please post a request for help and our MSO team will help you out!

Thanks,

Lt. Col. Yamagata

Edited by Candy 1st MRB

23 answers to this question

Recommended Posts

  • 0
Marchese 1st MRB Forum Admirer

Marchese 1st MRB

Posted
Posted (edited)

Hello all. I knows it's been a while but I am quite aware of the situation and will confirm. Apparently someone from my friends list had this virus and like a dope I fell for it and I am sorry for any problems this might of caused. I have changed my password to my steam account and am running antivirus I would advise you do the same. I did run antivirus on the file before opening it and it revealed no malware so that why I launched the fake jpeg. Ya think I would know better being in IT but guess I had a brain fart.

Edited by Marchese 1st MRB
  • 0
Ultranator BAR Forum Hot-Shot

Ultranator BAR

Posted
Posted (edited)

If you get a message from someone on steam that says:

WTF Dude?

definitely do not click on that.

It would be a virus. It almost got me until the img asked me for permission to run it....

Edited by Cannon 1st MRB
Removed the link - Cannon
  • 0
Griswold Forum Scholar

Griswold

Posted
Posted (edited)

SSgt. Grant seems to have been affected by this as well. If ANYONE sends you this message DO NOT CLICK ON IT!!!!!

Also post who you get these messages from, that way we can contact them on the forum about there compromised account.

Edited by Griswold 1st MRB
  • 0
Griswold Forum Scholar

Griswold

Posted
Posted
What if you clicked the link with your phone, but it didn't open the website because its not a real website or download anything.

I would say you would be good, probably built for a different operating system. But just make you pay attention to when/if you plug your phone into your computer next time. Make sure nothing fishy starts happening.

  • 0
Barry 1st MRB Forum Blow-Up Doll

Barry 1st MRB

Posted
Posted

REMEMBER GUYS ALSO LET THE PERSON WHO IS UNDER THE VIRUS KNOW THAT THEY ARE EFFECTED

BECAUSE THEY MIGHT NOT KNOW THAT THEY ARE

AND WILL CONTINUE TO GO ABOUT THEIR BUSINESS

WITHOUT SCANNING FOR VIRUSES OR FIXING THEIR PASSWORDS

  • 0
Yamagata 1st MRB Presidential Poster

Yamagata 1st MRB

Posted
  • Author
Posted

Anti-viruses work off of databases of "known" malware, that's why you need to update your protection so often, there are set definitions of viruses. In addition, it's using steam and your browser as a means to infect your computer, these are already "green-lit" by all your anti-virus programs. If it's new, it's not going to flag it as a known threat, this is where you, the user, needs to be diligent and check the source. Before I even clicked the link, I googled screen-picture or whatever the site hosting this "wtf dude" image. That's where I hit the "unknown site certificate" and pre-existing steam community posts results.

Google is your friend!

  • 0
Yamagata 1st MRB Presidential Poster

Yamagata 1st MRB

Posted
  • Author
Posted

Smart people have already debugged the virus! In case anyone was curious:

The method form the code is thus..

Hook into steam,

steal cookies,

get auth token,

get friends list,

send all items etc as per line + (753:gift;570:rare,legendary,immortal,mythical,arcana,normal,unusual,ancient,too

l,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key) ,

send message to all friends = ("WTF Dude? http://♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥.com/DELETEDFORSAFTEY/")

Nothing thing else is mentioned in the code... Wanted to check to make sure it never got my password for steam..

Note* it uses the steamapi to send authenticated requests with the stolen cookies, for the trade transactions*

Well it steals the cookie which means the attacker can change the password on you in theory.

It's prudent to deauthorize your SteamGuard computers and change your password as a precaution.

  • 0
Woz 1st MRB Forum Punk

Woz 1st MRB

Posted
Posted
Smart people have already debugged the virus! In case anyone was curious:

The method form the code is thus..

Hook into steam,

steal cookies,

get auth token,

get friends list,

send all items etc as per line + (753:gift;570:rare,legendary,immortal,mythical,arcana,normal,unusual,ancient,too

l,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key) ,

send message to all friends = ("WTF Dude? http://♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥.com/DELETEDFORSAFTEY/")

Nothing thing else is mentioned in the code... Wanted to check to make sure it never got my password for steam..

Note* it uses the steamapi to send authenticated requests with the stolen cookies, for the trade transactions*

Well it steals the cookie which means the attacker can change the password on you in theory.

It's prudent to deauthorize your SteamGuard computers and change your password as a precaution.

I was going to ask if someone could pm me the file url (or dropbox the file to me if the site has already been taken down) so that I could run it through IDA, but it looks like someone on the steam forums has already decompiled and analyzed it. I would still be interested in looking at it anyways, so if someone could hook me up with the file, that would be awesome.

  • 0
Sanborne Forum Expert

Sanborne

Posted
Posted

Today i recieved a PM from a friend of mine, While i neglected to take a screenshot it read as "Hey, I want to trade with you! Check My trade inventory @ *Link Removed*" then he logged out" I wont post the link, But research done on it says its not a trusted site and is most likely a scam / Phisher link.

  • 0
Griswold Forum Scholar

Griswold

Posted
Posted

Tifrobond has seemed to have come down with this virus, if anyone has him on there friends list check your recent messages with him. If you opened any link from him, SCAN YOUR COMPUTER NOW!!!!

  • 0
Griswold Forum Scholar

Griswold

Posted
Posted
Why do people suck so bad?

Real question should be why did it take so long for someone to look for a way to do this to someone? Steam for a long time had been a really good platform, why steal someones digital shit?

Steam is just like any other digital platform, why did it take so long for viruses that specifically target Steam to come out?

  • 0
Arsenault 1st MRB Forum Seeker

Arsenault 1st MRB

Posted
Posted
Why do people suck so bad?

Real question should be why did it take so long for someone to look for a way to do this to someone? Steam for a long time had been a really good platform, why steal someones digital shit?

Steam is just like any other digital platform, why did it take so long for viruses that specifically target Steam to come out?

Hats.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to question listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Recent Posts

    • Fielding 1st MRB
      2nd Platoon Weekly Attendance

      By Fielding 1st MRB · Posted

      2nd Platoon Weekly Attendance   Week of 27APR2025   P = Present | E = Excused | A = Absent   Platoon Staff CWO. A. Pitteway - Present 1stSgt. J. Candy -  Present GySgt. A Yoder -  Present GySgt. R. Fielding - Present   1st Squad Squad leader:  Cpl. M. Noel - Excused Cpl. B. Grande -  Present Cpl. R. Smith -  Present Cpl. C. Keebler - Present Pfc. D. Moffat -  Present     2nd Squad Squad leader:  SSgt. S. Holquist - Excused Cpl. T. Scary -  Present Cpl. C. Marsh - Present Cpl. W. Swift - - Excused Pfc. M. Oake - Excused Pvt. R. Zera - Absent Pvt. J. Coelho - Present  
    • Yoder 1st MRB
      Ban Report :: Brother Bear

      By Yoder 1st MRB · Posted

      Name: Brother Bear   Steam I.D: STEAM_0:0:120956468   Duration of Ban: Permanent   Reasons for the Ban: Racist comments   Demo Provided?: N   Comments: Said the N word a couple of times
    • C. Smith 1st MRB
      [Accepted-Discord - HLL030] Enlistment Application Paul Smith

      By C. Smith 1st MRB · Posted

      Welcome to the 1st Marine Raider Battalion! Now that you have been accepted don't forget to: 1. Check in at the Recruit Depot 2. Read the Marine Raider Handbook (you are expected to know everything in it) 3. Change your steam friends Avatar 4. Download, install and log into Discord NOTE: Please be aware that you will not have access to the above links until an officer has given you full access to the forum. Access to the forum should be given to you within the next day.
    • P. Smith 1st MRB
      [Accepted-Discord - HLL030] Enlistment Application Paul Smith

      By P. Smith 1st MRB · Posted

      I've read and understood the rules 
    • C. Smith 1st MRB
      [Accepted-Discord - HLL030] Enlistment Application Paul Smith

      By C. Smith 1st MRB · Posted

      MARINE CORPS ENLISTMENT OFFICE Camp Pendleton, CA   RECRUITMENT LETTER     Hello Paul Smith, Thank you for taking interest in joining the 1st Marine Raider Battalion.   During your trial period the following will occur: Once accepted as a Recruit, you will remain as a Recruit for 2 weeks from the day of your acceptance until the next BCT Class is offered. During your time as a recruit, it is highly encouraged to play within the Public Server and join Discord with our other members. Upon acceptance, you will be contacted by one of our DIs when the next available BCT is scheduled via the appropriate Discord channel.   We have a BCT class every two weeks. Please keep an eye out for when the next one is made available once you've completed your time requirements!   Upon stating that you understand all the information here, an admin will change your forum name and login to be :   P. Smith 1st MRB   Take the time now to change your Steam and in-game name to:   Rec. P. Smith [1st MRB]     Please make sure to verify your forum account by checking your email. Also, please respond below with a reply showing that you have read and understand these rules. You cannot be fully accepted until you do so. We have a limit on the time to reply, if you do not do so within 48 hours, your application will be denied. Once you reply, you will be approved for your trial period unless otherwise posted.  
×
×
  • Create New...