This is not yet verified and I'm waiting for a response from steam moderation.

I recieved a message that appears to be a steam phishing website.


The account asked me to go to this website and vote for them in a tournament.

I checked the website in a virtualized enviroment and it has what appears to be a fake steam login window. The window tries to look like another window in your browser but the difference is it cannot go outside the bounds of the website.

You can drag it around the website but not OUTSIDE the website.

The website asks for your username and password.

At this time I recommend you DO NOT enter any information and do not click any links.

If you have entered information then contact steam support asap to report your account may be compromised.

This may turn out to be nothing but for now I'll treat it as phishing.

Valve says they are investigating and believe the source code leak to be the leaked source from 2018.

RCE and API claims MAY have been fabricated by forum users.

Valve are still investigating but are giving the ok to play source games.

(SEE UPDATE ANNOUNCEMENT REGARDING THIS ISSUE)

It is recommended not to play source games until valve gives the ok on if it's been patched!

This exploit allows hackers to execute code on your computer through the game itself. This can result in any form of malware being injected into your system.

It is currently unknown what source games are affected. We do have confirmed reports that TF2 and CS:go are vulnerable to the exploit.

Play at your own risk to your computer and your accounts!

This scam tells you:
♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥♥! Go to <malware link> and take the skin you want.


Inform your friends not to fall for this scam! It hijacks, steals your account, steals your inventory items, and other malicious activity.

If you or your friend has been hijacked you should follow these instructions ASAP to avoid losing your inventory items or getting VAC banned by hijackers.

https://psteamhelp.yuanyoumao.com/en/wizard/HelpWithAccountStolen

You can also go to the infected friends profile, click the report icon, and choose reason:

----
"They are involved in theft, scamming, fraud, or other malicious activity"

"Their account seems to have been compromised"

"Submit this account for review"

Include details telling why you think your friend has been hacked and submit.
----


I haven't been able to get ahold of the malware steam hijacker so I don't know what it includes. I do know it locks you out of your account, steals your account items, and sends malware url to friends through direct message to attempt to infect them as well.

Inform your friends and stay vigilant peeps.

This new scam not only steals money but also installs malware to your computer and sends messages to all your friends as a chain mail. Beware of any links offering ♥♥♥♥♥♥♥♥♥♥ INCLUDING friends you trust!