Announcements and discussions regarding Huwhyte KF2 HoE+ and CD servers

Steam account hacked

My steam account was hacked on 2/4/2026. The only damage is "hey bud" type of convos with 16 friends on my FL of ~140 people, followed with a request to follow this twitch account:

https://www.twitch.tv/happyez1

Beware, that this twitch account, which hasn't been taken down yet, in its "about" section has a link to a phishing page pretending to be Steam:

https://www.zsdr.org/aux/steam-phishing-page.png

https://www.zsdr.org/aux/login-phishing-page.PNG

Only 4 convos out of the 16 ended up with the hackers posting this twitch link.

I don't know how it happened and there's only inconclusive info on how this may have happened. If I was really pressed to choose just 1 hypothesis, I would say it's something on Steam's end, but again, it's inconclusive.

I am really sorry for what happened and apologize for the risk I inadvertently exposed my friends to. You can consider me a ♥♥♥♥♥♥. I actually am and on a couple of occasions here I admitted it already. In some things I am ahead of most, while in others I am totally retarded. I never pretended to be a know it all, oftentimes bring up an idea that only as a crowd we can do big things and errare humanum est. If I do retarded things I am openly willing to be called out on them. This apology is here for a hypothetical case that it was my ♥♥♥♥♥♥.

Of course, having plenty of enemies here who keep reporting me and managed to get me banned on a number of other platforms, it's going to be a nice day to celebrate for these ♥♥♥♥♥♥♥ that Carl was hacked, LMAO. I don't care in the slightest. It's a major part of my life philosophy to be open for criticism. I don't pretend to be better than I actually am and don't sweep anything under the rug. Such as this hack.

The goal of this post, as it's typical in this blog and on ZSDR, is to share all the available info, so others can learn valuable lessons from the mistakes made and maybe change our society for the better.

I opened a support ticket with Steam regarding this. My hope was they can share some data, such as web access logs, that can bring more clarity to this hack. Steam support proceeded to disregard the evidence I've shared with them and to accuse me of:

* entering my steam password on phishing websites;
* letting the hackers steal my steam authentication cookies;
* running malware on my PC.

Let me first establish the facts and then try to corroborate different scenarios that may explain what have happened.

* At the time of the attack I used MFA with an email one-time-code. Whatever the hackers did never triggered it.
* I ever interact with Steam while authenticated only on 1 single Windows 10 PC. No family, no other devices, no mobile device, no other PC.
* I used this 15 chars alphanumeric randomly generated password for Steam: "V1DoddLh9bd77tr" without quotes. It was managed purely by 2 password managers. One is keepass 2.x, another is built-in into the browser. Both protected with a dedicated long alphanumeric master password. I.e. I don't know the password off the top of my head and never knew, I wouldn't be able to enter it anywhere, unless I had the command of my password manager. Although this password isn't the hardest to crack, it still rules out any "password reuse" situation or pretty much rules out online brute forcing.
* I literally never copy/pasted this password on any other device, but this PC.
* I never used any Steam integration platforms, regardless if they require providing Steam user/pass or not.
* I never entered this password on any non Steam websites, regardless if they were phishing or not. I recognize Steam websites through their domain name in the address bar, not by the insignia.

With that background in mind, what actually happened:

On 2/3/2026 I turned off the PC and went to bed. Next morning, 2/4/2026, upon booting up the PC and having the Steam fat client started and logging in automatically, I discovered leftover chats with multiple people from my friends list and another couple of people from my FL that ended up being blocked (which automatically unfriends them).

All chats follow the same script, start with "sup bud" or a similar phrase and, if not dropped, finish with sending the link to that twitch account with a note, that it has a steam profile referred there and one can send the friend request by clicking the steam profile, which as I now know, redirects to the phishing page.

So, the hackers goal seems pretty obvious here. It's nothing sophisticated. Just luring as many people as possible to a phishing page in hopes they click the "add friend" button and enter their Steam username/password on the phishing page.

So I changed my Steam password, enrolled in Steam Guard on a mobile phone which Steam considers to be superior to email MFA, which tangentially revoked my Steam API key, which is something that isn't documented anywhere, which caused the "state of the game" ZSDR page few hours long downtime. And started investigating. Being a KF2 modder it's quite obvious I have some IT knowledge and I do these things periodically for my extended family, so here I am, investigating my own hack.

NOTHING ELSE of note has happened. Specifically:
* My Steam account password wasn't changed.
* My email used for MFA didn't receive any one-time-codes.
* No game or item transfers, no attempts to buy any content, change pfp, name, post any crap in this Steam community. Nothing, but the chat messages to 16 seemingly random people on my FL.
* No any rogue devices shown in the "Account details">"Security & Devices">"Authorized Devices" section.

https://www.zsdr.org/aux/security-page-steam-red.PNG

Outside of Steam also nothing has happened. Google account, Microsoft account, bank account, the email account used for Steam MFA, any other account on any other website, for which I have 289 entries in my password manager, were hacked.

Now, the $$$$ question, is how did the hackers manage to hack my Steam account?

There's a couple of options here.

1. Malware on my PC. This can: keylog any passwords I enter, capture the clipboard, recover all plain text passwords from the password manager, steal and exfiltrate authentication cookies from all browsers.
2. I entered my Steam username/password on a phishing website, similar to the one that's referred on this twitch user profile.
3. Malicious active extension in a browser that has permissions to "Access your data for all websites". Extensions can interact with webpages and spy on the data, but they can't escape the browser's sandbox and, say, access files on one's PC, unless they also can exploit the "red pill" sort of vulnerabilities which are quite rare and very expensive to get.
4. Or, it's an issue on the Steam side. Say, a malicious insider who abuses their backend system to send these messages directly, or to forge authentication tokens pretending to be anyone and send to his buddies, or it's a zero day vulnerability in Steam API that allows to impersonate anyone.

Let me explore all these and weigh in on their likelihood.

The malware issue.

On day X I did the scan with the help of MS Defender, which usually is useless against any advanced malware. It flagged a few of the free forensics tools I used for this investigation. I ignored it. I also downloaded and spent a lot of time with MS forensics tools, autoruns, process explorer and process monitor, that allow to observe things like process branching, verify the digital signatures validity of running processes, inspect all the autostart locations typically used by malware for persistence. Total time spend on this work is about 50 hours across multiple days. Nothing.

I also kept running for a long while a network forensics tool called "Smart Sniff" to get an idea what goes out to the internet. The malware has to exfiltrate the valuables it finds, so there would be outbound traffic from a sketchy process or a hijacked process that typically doesn't generate such type of traffic. Nothing.

And, finally, which is arguably the biggest argument, is that NOTHING ELSE HAPPENED. Like, if it was hackers on my PC, wouldn't they want to compromise the email as well? Online banking? Whole password manager with all the websites? Why just a pathetic Steam chat? There is no good explanation for this.

Let's say it's a super advanced malware. Chinese nation-state sponsored threat actor. Stacking zero days upon zero days to stay invisible and spy on poor ♥♥♥♥♥♥♥ Carl, LMAO. Who is a literal nobody, FYI. Some obscure gamer, playing and modding some obscure niche game. And they are, like, hey, let's send chat messages to 16 of his friends on Steam, not bother being sneaky about it much and leave some of these chats behind opened and just post a chained phishing link nobody is likely to clicks on. Not gonna bother with anything else Carl has, including banking, personal info (e.g. to open fake credit lines), email accounts, other websites. How likely is that?

Not much. I would say pretty much near zero.

Also, just to rule it out, I checked what if my PC turned itself while I was asleep, did some bad things, then turned itself off. Technically it's possible. I checked the eventlog and according to the log it wasn't the case:

https://www.zsdr.org/aux/my-pc-was-offline.PNG

Outside of state-sponsored malware, no tools exist that allow to manipulate the Windows eventlog. One can fully delete it, which is noticeable, but for that one requires admin rights.

I also thought that what if it's a sophisticated supply chain attack and the way I acquired this malware because it was bundled with some sketchy free software and it stays reaaaally low profile and dormant most of the time and if it does execute, it does so inside of the process of said compromised software? So I checked all the software I've installed in the last year:

https://www.zsdr.org/aux/year-long-installed-software.PNG

As you can see, all are major software products. Installed by tens of millions users in the world. If any had malware, there would be a huge uproar on the Internet. Instead, it's dead silent.

So, no. Likely not malware.

But what if I am even more retarded than I actually am and entered my steam username/password on a phishing website?

The obvious counter to that is I don't recall doing it. So, unless I am a full schizo, it didn't happen. But in case I somehow am, I decided to not just trust myself and check what sketchy websites did I visit in the last 100 days. Why 100 days? Just a round number that is deeper than for how long Steam browser cookies seem to live without them being renewed for about 5 weeks:

https://www.zsdr.org/aux/steamcommunity-authentication-cookies.PNG

So I took the browsing history for 100 last days. I assumed that any phishing website pretending Steam, like the one the malicious twitch account refers to, has to either have a word "steam" in it's URL or in it's browser window title. Then I filtered it by these 2 conditions and deduplicated. The result:

https://www.zsdr.org/aux/domains-visited-last-100-days-with-title-or-url-containing-word-steam.PNG

As you can see, there's only 1 sketchy website on the last line, which is the one this whole hack was about. I visited it only after the hack to learn what's in there. Proof:

https://www.zsdr.org/aux/times-of-visit-phishing-site-last-100-days.PNG

The question is, for ♥♥♥♥♥♥♥ in Steam support, but also all the other ♥♥♥♥♥♥♥ in the whole world, where exactly I could have entered my Steam username/password into, which could have resulted in this hack? There's nothing.

Not to mention, that I have MFA on my account. Supposedly, if someone tried to login with stolen username/password from a device that hasn't been already authorized, this would have triggered the one-time-code in the email. It didn't. If they somehow managed to bypass the MFA, it would have added a rogue device to the authorized devices list. It didn't.

So, the phishing for username/password scenario is very unlikely.

Malicious extensions, what about it.

Unfortunately, I was running about a dozen, but most of them have no permissions whatsoever and only 3 had permissions to "Access your data for all websites", namely:

* google-no-tracking-url
* disconnect
* uBlock Origin

These are all relatively rarely used, because these are backwards compatible extensions for a rare web browser I mostly rely on, which is "Waterfox".

It is possible for an extension to either be straight up malicious, in which case a user has to be lured into installing them, or legit extensions can turn rogue, if bought or hijacked. This is a scenario of a supply chain attack. Seems pretty convoluted already for the pathetic goal of sending chat messages to 16 friends on Steam, LMAO.

Here's one example of such advanced malware used to hijack people's crypto:

https://www.bleepingcomputer.com/news/security/hackers-use-rilide-browser-extension-to-bypass-2fa-steal-crypto/

Luckily, most extensions are open source or even free software, and even if not, they are written in JS and are relatively easy to inspect. Here I extracted all, even disabled, currently installed extensions:

https://www.zsdr.org/aux/extensions-list.PNG

Ran a few queries that would indicate session manipulation or cookie extraction:

https://www.zsdr.org/aux/extensions-search-for-cookies-or-session-manipulation.PNG

The only interesting code snippet was from a disabled old "flashgot" extension, then reviewed in npp:

https://www.zsdr.org/aux/flash-got-cookie-handling.PNG

According to AI, it's needed to pass the session information to the download manager of choice, because otherwise, the websites wouldn't give the file. It makes sense.

Besides, not only cookie reads are required for the extension spyware to work. They also have to contain the logic to exfiltrate it to the malicious website on the internet. AI has found none and assured me that I am tripping. According to AI, these are all respectable extensions used by many and no way they can contain malicious code.

Another venue to explore was if these extensions were hijacked, in which case they would have a recent update date, starting from which they turned rogue. The only recently updated was ublock origin, a GPLv3 free software with fully transparent code that does absolutely nothing sketchy.

So, nothing.

Another argument against a malicious extension is there was another victim from my FL who suffered the same fate. They also reported that nothing else was touched. They didn't have to recover their account, as the password wasn't changed, the account wasn't renamed, wasn't robbed, no purchases, items theft, no other thing on their PC besides Steam chat was touched. They also were compromised on the same night, imagine that.

So, this person uses Chrome and 2 extensions with it, which I also checked and haven't found anything of interest. So, no common factor in terms of malware or extensions between us 2.

So, what about the ♥♥♥♥♥♥♥ at Steam? Not only they frivolously accused me of ♥♥♥♥♥♥♥ up my account security, with zero evidence to support it, they said the following:

"I'd like to note that the account's security is still the responsibility of the account's owner, and Steam support can only provide tips and help you get the right tools and information to keep your account secure."

This is obviously ♥♥♥♥♥♥♥♥. Account security is a SHARED RESPONSIBILITY between the account holder and the identity provider, which is Steam. It's as easy to prove as to bring up a single case when the compromise has resulted, proven, from the identity provider compromise. Recent breach stemming from another breach:

https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift

2013 Yahoo compromise (1 bn user accounts were compromised, Yahoo was denying it happened for 3 years):

https://en.wikipedia.org/wiki/Yahoo_data_breaches

2023 Microsoft "Storm-0558" breach:

https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/

In all cases, their customers didn't do anything wrong. Yet, their accounts were compromised. Simply because the identity provider's poor design. But, of course, this cannot happen to Steam. I quote from my ticket:

The Steam system being secured, the only way for a hijacker to gain access to an account is for the owner to take risks with the security information

...

I can say that the data we have makes it very likely you were either the victim of malware or phishing.

...

Steam Support does not provide in-depth analysis of account intrusion cases, but you can rest assured the only cases where someone can gain access to your account are those where the login information had been provided to someone else by you or someone you'd trusted with that information, or an attacker was able to gain physical or remote access to a machine you'd authorized to use your Steam account. You can rest assured that Steam has a world class security team, and none of the other intrusion vectors you've mentioned could have occurred here.

See. These smug ♥♥♥♥♥♥♥ are better than Microsoft, Google or Yahoo. World class. No such an issue can ever happened to them. No stupid ♥♥♥♥.

For the sake of completeness, Steam support shared the links to these articles helping with securing the accounts:

https://support.steampowered.com/kb_article.php?ref=1266-OAFV-8478
https://support.steampowered.com/kb_article.php?ref=6057-YLBN-1660
https://support.steampowered.com/kb_article.php?ref=4440-RTUI-9218

You can check them and see for yourself how retarded all that advice is and how it simply doesn't work. If you follow all that to the T, as I have experienced myself, there's no guarantee you don't fall victim to that hack.

All these retarded bootlickers you can find in similar threads, regurgitating Steam nonsense, know nothing:

https://www.zsdr.org/aux/smug-advice-1.png
https://www.zsdr.org/aux/smug-advice-2.png

So, with Steam refusing to cooperate with the logs and closing the ticket with no ability to reopen it, this investigation is left in an inconclusive state. None of the theories is solid, but at least, I hope, I supplied some evidence making the compromise on my side less likely. All while Steam support resorted to mere hand waving and shared zero evidence whatsoever.

In the end, I'd like to bring up the argument of my other friend who was compromised that night. He also had no consequences whatsoever, besides these chats. All while having a different browser and extensions. Also reports never doing anything sketchy.

This may hint that there was a large campaign that night. So, I have 140 friends on Steam and out of that crowd 2 ended up compromised this way. What are the chances of that happening simultaneously, if it was a regular account phishing or malware compromise? It's a wild guess as coincidences happen, but if we inaccurately extrapolate from here, it's like every 1 in 70 Steam accounts were hacked this way and all on the same night?

For the hackers it's not economically reasonable to sit on compromised identities for a long time, because they expire. Cookies expire, passwords change and so on. So, naturally, they typically act quickly, most of the time immediately, as soon after getting hold on the account info as possible. They usually don't try to time many compromised accounts to pull off the big bang hack on one night.

On the other hand, if it was a massive campaign, it's another argument for the Steam compromise. Say, a min wage India support employee forging hundreds of authentication tokens and sending to his cronies. Or manipulating the system some other way, by simply inserting chats into the database. Or a similar hack to that Microsoft one, which allowed the hackers to forge authentication tokens for any MS customer they wanted.

I'm not sharing the screencaps from this my friend for privacy reasons, but if Steam support were willing to cooperate, we would get there. Some of my friends, LMAO, received these "sup bud" chat messages from BOTH of us and they can confirm the story, if needed, or if you know who to ask. In the end, despite me asking for various logs, for abused cookie types lookups (e.g. browser vs fat client or "authorized devices" behavior or "SteamMachineAuth" behavior), did exactly nothing, so probably we may never get full clarity here.

Somewhat similar weird cases that either have inconsistencies or no resolution:

https://www.reddit.com/r/SteamScams/comments/1iqfx1k/a_friend_request_scam_but_not_in_the_way_you/

https://psteamcommunity.yuanyoumao.com/discussions/forum/1/2270319347582795685/

Cheers everyone and, because it seems you can't stay safe despite following Steam recommendations, my advice is to abandon this garbage platform before it falls apart.

https://www.zsdr.org/aux/havent-given-steam-money.PNG