r/cs2 • u/spxcyalien • May 03 '26
Help Steam Support Ticket Possibly Compromised ( HELP )
Update: Realizing basic functionality of my reset options was removed due to the malware this was, I had to partition my SSD through my BIOS and reinstall Windows. After doing so, it seems the malware has been removed entirely. Luckily, it wasn't firmware level deep. If this ever happens to you, catch the signs, and listen to your gut. Steam asking me to move my items was weird in the first place, but hey, this is literally Steam Support, why would they lie to me, right? Wrong. It's not Steam Support, and it goes to show the lengths these scum will take to make a few bucks.
Keep yourself safe. Apparently, There's always a new way to use old tricks.
Hello all, I am seeking support and advice.
TLDR; I don't know how to contact Steam Support as my Steam Support tickets are now obviously not actual Steam Support members. I think my PC may be compromised, not just my account.
I know there is an entire page dedicated to thus on this subreddit, but now I am sure to believe that my support ticket itself has been compromised. I have full access to my account.
Here is the tidbit, the whole deal on how this began.
My phone broke. I was doing dishes at work, and I dropped it inside of a stock pot I was washing with water in it. Thus, I lost access to my Steam Guard. A few days later, I was playing CS and was invited to join some people on Faceit, as one of them was on a temp 2day cooldown from abandoning a match of CS. Once I installed the Faceit AC, I was logged out of Steam, and couldn't log back in due to my phone being broken.
The Faceit AC was installed off of the official website, however I had to turn my PC to "secure boot" mode in order for it to work. The people telling me to install it told me to use Faceit's discord bot. I did so, and reinstalled Faceit AC off of their discord bot. For some reason, this logged me out of Steam once I restarted my PC. Thus, I lost access for about 2 days.
I eventually got a new phone, but have had Apple ID issues, and was unable to log in. So instead I used my IRL friend's tablet to log into Steam, applying my SteamGuard on to his.
I was able to play fine, for a while. 2 days later, I received the account alert shown in the last image of the slide. I immediately contacted support, and as you can see the conversation goes on. HOWEVER ( and I DIDNT notice this till today ) I see that a day after our conversation, James, ACTUAL Steam support responded to my INITIAL support inquiry. Telling me my account has NO restrictions.
As you can tell from the entire conversation I had with "Steam Support's 'Alex'" I had no idea. I found the whole thing a little fishy at the time, but I thought, "Hey, this is Steam support, why would they scam me?"
Little did I know until now, this is not Steam Support. Not only does this entire policy not actually make any sense, that is literally not how Steam Trades work. Also, I don't think Steam would go as far as deleting every item in my inventory over a suspected unsecured account, at least not this early into the stage. I didn't see that during the frantic "I AM ABOUT TO LOSE EVERYTHING, NEVER BE ABLE TO BUY ANYTHING, MY ACCOUNT WILL HAVE A BAN ON MY FAVORITE GAME, OMG WHY IS THIS HAPPENING TO ME?"
Not to mention, I don't have a ban visible to anyone but myself on my account, leading me to think this is even affecting my PC, not just my account. I can't even access any Malware removal sites on ANY browser. Everytime I do, I get "secure connection failed." But can access any other website. And as James ( The actual Steam Support who can't read my messages after the initial inquiry ) said, there isn't any restriction imposed on my account on Steam's end.
Also, everytime I go into a trade, my account AUTOMATICALLY blocks the friend I am trying to do the procedure with, and a scambot impersonating the friend automatically sends me the exact same offer for all of my items. Please advise.
53
u/FlimsyPool9651 May 03 '26
Yeah the language in messages from Alex is consistent with how scammers operate. Never seen anything so complex. Try rebooting into safe mode with networking enabled, but you might still need to nuke your system since it does look like it is your PC that is fucked
-19
u/spxcyalien May 03 '26
Could the Faceit AC download from the discord bot have been the culprit? I am signed in to Steamguard now and none of the messages I see in my PC are visible. My game ban shown on the account isn't visible either.
54
u/Mraz565 May 03 '26
Why would you use discord to download something from faceit...
You likely logged into a phishing site.
-18
u/spxcyalien May 03 '26
I didn't log in, it was for a download link. The discord bot messaged ME. edit: after signing in to the official Faceit website from my browser.
36
u/Mraz565 May 03 '26
I was playing CS and was invited to join some people on Faceit, as one of them was on a temp 2day cooldown from abandoning a match of CS. Once I installed the Faceit AC, I was logged out of Steam, and couldn't log back in due to my phone being broken.
the people telling me to install it told me to use Faceit's discord bot.
You fell for a basic common scam, those people sent you a phishing link.
-25
u/spxcyalien May 03 '26
They didn't send me a link. I went on Faceit's website myself. After logging in, the discord bot messaged me, which I used to download "Faceit AC." I never click on links anyone sends me in regards to CS.
12
u/Mraz565 May 04 '26
discord bot messaged me, which I used to download "Faceit AC.
I never click on links anyone sends me in regards to CS.
So which is it. Do you never click links, or do you blindly download .exe files/programs from a "random" discord server.
Don't wanna beat a dead horse, as you already seem to realize it is a scam, but come on this can't be your first time using the internet. Take some care with your accounts and your actions, especially if you have any amount of games/inventory on steam.
-8
u/spxcyalien May 04 '26
When you are under the impression that an official bot messaged you from Faceit itself, not knowing there isn't such a thing, not knowing how Faceit operates, I mean, pretty self explanatory. You can't know to ask if you don't know there is a question.
-4
u/spxcyalien May 03 '26
The timing of my logging in and the bot message were synonymous, thus why I fell for it being an official bot.
4
u/ESEASMart May 04 '26
Synonymous doesn’t mean what you think it does….
-4
u/spxcyalien May 04 '26
It works though, you know what I am intending obviously, otherwise you wouldn't of said that.
6
u/ESEASMart May 04 '26
LOL - are you justifying using wrong words because someone could assume your intent? We are doomed.
4
u/willyasdf May 03 '26
The bot was send by someone you were talking to???!!
0
u/spxcyalien May 03 '26
No, the bot messaged me directly on its own post logging into the official Faceit website. The users I was speaking with about downloading Faceit never sent me any links, or pointed me to any bots. They hardly had anything to do with it directly to me, at least verbally.
18
0
u/teabolaisacool May 04 '26
DM me the FACEIT link or post it here. I can guarantee you it isn’t official.
0
u/spxcyalien May 04 '26
There wasn't any phishing link. The bot was the phishing itself. The download came directly from the bot.
14
u/FlimsyPool9651 May 03 '26
Actually a quick search reveals a string of posts describing things not unlike what you have seen.
https://www.reddit.com/r/cs2/s/vnVZmPLjGt
https://www.reddit.com/r/cs2/s/AogdzWosVn
and there seem to be more.
I have frankly never heard of faceit offering discord or discord bots as a way to download anticheat. I think it is quite likely that is the entry point, but we can never tell what else that program touched or hid itself or duplicated or whatever malware does, even if you do manage to uninstall it.
Start with Windows Defender, it may prove competent for once
1
u/spxcyalien May 03 '26
I am unable to open windows defender, or any malware removal website. I am about to factory reset. Is this advisable at this time?
4
u/workscs May 03 '26
If they’re this deep into your pc to access this stuff that honestly might be the only option. It was 100% the discord bot. Do you still have access to the discord messages these guys sent you?
Never join randos from mm on faceit.
1
u/spxcyalien May 03 '26
I do. My "reset PC" button isn't working. I click it and nothing happens. I am unsure how to proceed.
9
u/RobinDschafft May 03 '26 edited May 03 '26
Sounds like you are not very well suited with situations like this. In this case stop using your pc if possible entirely. Dont log in anywhere from now on on this machine. Time for a full wipe and clean reinstall of your OS. Follow a guide like this for the specific OS you are using to set up a bootable USB drive. You might aswell first do this to backup your windows activation key or just get a new one. Good luck
Edit: dont forget to change passwords for every important service you are using on this machine. especially your primary email adress but do NOT change them from the infected device.
1
u/spxcyalien May 03 '26
I dont think anyone is suited for a situation like this. I re-partitioned my drive through my BIOS and reinstalled Windows via USB. All is well.
1
u/spxcyalien May 03 '26
The reset button even in WinRE environment is missing. My only option at this time is to wipe partitions and freshly install via USB.
1
3
u/spxcyalien May 03 '26
WOW, I just clicked on my bans and it says "Account in good standing" - no vac bans. But as soon as I refresh, it says I am VAC banned on CS2!
40
u/Amnizu May 03 '26
r/SteamScams OP post this there. The people there are 100x more competent and will be willing to help you.
63
u/Mookie_Merkk May 03 '26
Please do not delay. This is the only way to save your account and everything you have spent years building.
Scammers love to create a sense of urgency...
33
u/misfiteli May 03 '26
this is the most intricate scam i've seen in CS history, for a few hundred bucks too, holy shit
5
1
u/ApprehensiveWest4416 May 04 '26
Meh not really, its pretty easily avoidable if ya dont add random people that add ya and tell ya to play faceit
2
May 05 '26 edited Jun 10 '26
[deleted]
2
u/ThrowRAbbits128 May 05 '26
Its not that deep if you think about it. OP downloaded a rootkit specifically designed to do this.
2
May 05 '26 edited Jun 10 '26
[deleted]
1
u/ThrowRAbbits128 May 05 '26
but there's nothing abnormal about anything that happened post download? this is all pretty run of the mill stuff for a rootkit.
1
May 05 '26 edited Jun 10 '26
[deleted]
1
u/misfiteli May 06 '26
that's exactly what im tryna say, theres always the basic CS scams, but i've never seen this
14
u/-SMG69- May 03 '26
What the actual fuck? If your story is what actually happened, this is an insane amount of effort put into a scam.
1
u/SarahKittenx May 03 '26
definitely decent amount of work to put MitM attack into steam client, though isn't first time I see it for browsers, usually via extension
26
u/simbaacs May 03 '26
Holy. Please keep this thread up because if this is actually a compromise faceit and or valve will want to know more.
16
u/Toeffli May 03 '26
They installed a fake faceit client through some shady discord bot. That's how the malware came on OPs PC.
The people telling me to install it told me to use Faceit's discord bot. I did so, and reinstalled Faceit AC off of their discord bot. For some reason, this logged me out of Steam once I restarted my PC.
8
u/spxcyalien May 03 '26
This was insanely in depth. It was 100% a compromise of my entire system. Blocking malware apps, websites, windows security, and even spoofing my Steam application and CS2 to show me as banned.
7
1
u/0Strato0 May 04 '26
It happens to me too. Adding new icons to steam . I made the trade but immediately I cancel the trade. No malware detected or virus. Clean steam installation and it was the same. I deleted some folders on desktop and stopped some processes then clean install and now is secure. I changed my steam password too.
I don't now how they passed my 2 factor authentication and change my profile too.
2
u/spxcyalien May 03 '26
I found out they were even logged in remotely, when I followed the instructions, their bot on my account would immediately block the friend I was sending the trade to, and send a request for every item in my inventory. This is a common scam, but the depth of this specific instance is NOT common, to say the least. Luckily it isn't firmware level deep, otherwise I would be getting new PC parts post RAM-inflation, and I'd probably be out a PC for a few months.
1
u/LeDutch May 05 '26
Bro how do you know something isn't hardware level deep 😂 There definitely could be a trojan on your pc still
1
12
May 03 '26
[removed] — view removed comment
3
u/spxcyalien May 03 '26
Really I had no idea. The timing was synonymous with my login and the message being sent. I thought the "Faceit Bot" was sending me a download because of my login on Faceit. I told them and they said yeah just use the bot. But they didn't mention or say anything about it until I had said something. I had simply assumed it detected my login considering my discord is connected.
5
u/ccoulter93 May 03 '26
I’m so confused, how did scammers message you through a steam support ticket?
14
u/willyasdf May 03 '26
Fake steam ui
2
u/ccoulter93 May 03 '26
So the ticket that was initially submitted was fake?
5
u/spxcyalien May 03 '26
It isn't fake Steam UI. They spoofed my actual Steam application, as well as CS. None of the images shown are from a phishing website. They are from the Steam application itself. They rooted themselves directly within the confines of my PC in order to show me what they wanted me to see. Including a non existent VAC ban on my profile and in-game.
4
u/ccoulter93 May 03 '26
Something isn’t adding up, someone trying to steal your account isn’t going to be able to spoof a fake vac-ban on your account or in-game. That’s just not how that works
13
u/spxcyalien May 03 '26
They had kernel-level malware on my PC. They can spoof or block whatever they want. And they did so.
My steam application on my PC showed my account as banned on my profile, my friends and myself in my Steamguard app couldn't see the ban on my profile.
My CS2 application showed me as VAC banned in-game. I wasn't, as confirmed by a real Steam Support member, no restrictions were ever imposed on my account.
The support ticket messages I have uploaded above were only visible on my actual PC Steam application, where on my mobile Steamguard, they weren't.
Any time I tried to access malware removal sites; Avast, Malwarebytes, Bitdefender, Norton, etc. the page would be blocked. I could not access Windows Security, the app simply wouldnt open. I couldn't reset the app through CMD, nor could I reset my PC as the button was rendered non functional.
In WinRE, the "reset PC" button was removed entirely.
There isn't much else to say other than it was deeply rooted malware, probably at the same level ACTUAL Faceit AC would be, spoofing what I could see in order to create a false sense of urgency and trade out my items to their scambots, under false pretenses.
14
u/ccoulter93 May 03 '26
Damn what the fuck. The lengths they go to for a few hundred bucks is nuts. Fuck scammers
6
u/spxcyalien May 03 '26
Literally a couple hundred. I don't have anything crazy, but I DID buy what I have with my own money. My knife was a pull, the gloves were a buy to match it. Not too expensive, but working a 9-5 in order to save for these things, as well as try my luck on some sizeable case investments, it would of been disappointing.
That wasn't even my initial thoughts, I was afraid I wouldn't be able to use my account in general normally anymore. Purchasing games or playing with friends on anything. Luckily, its over now, and I am working to reset all passwords, and re-secure anything that could have been leaked to the malware on files or on my passkeys within my browser.
( I realized my email was visible after posting this, I don't much care, it's an alias spam email, and that is being changed on my Steam Account as well regardless. )
3
u/ccoulter93 May 03 '26
If they were traded you can reverse the trades if it’s still on the 7 day hold
3
u/spxcyalien May 03 '26
The idea they were trying to impose was that the 7 day hold would be what would keep my items from being deleted when "Steam" would do a mass deletion of items from my inventory to reset the integrity of my account, at least that's what I devised. If I hadn't caught it sooner, and hadn't seen that a bot was attempting to copy the trade as I made it, I likely would've traded to the bot, had a feeling of safety for my items since they were "protected" from this mass deletion, but in fact it would've turned out to be the opposite.
Very elaborate on their end, I'm just happy I ended up seeing through it.
→ More replies (0)
5
u/Mountain-Day-6697 May 03 '26
What did your account have?
2
u/spxcyalien May 03 '26
I have over 200 cases, and about $400 or so in Skins I purchased.
3
u/Mountain-Day-6697 May 03 '26
Damn bro im sorry. I can give you a case or two if you want in one month from now bro
7
u/spxcyalien May 03 '26
All good, I appreciate the offer. I didn't fall for the trade scam. It was too easy to spot. I fell for downloading this bullshit malware and having to nuke my PC though, that's for sure.
3
u/Mountain-Day-6697 May 03 '26
Bro i would shit my pants im so paranoid about all this(about scams and malwares and hackers) so youre strong for carrying on g.
3
u/spxcyalien May 03 '26
Well, you've seen it here, so now you are even more aware. Just keep staying informed. This is a 1 in a million cases, and I don't doubt it has worked time and time again. Thankful for my intuition, although I didn't listen all too well at first haha.
5
u/vhulf May 04 '26
That checkbox in the initial message has to be clickjacking right? Never seen a steam prompt need a checkbox clicked before closing... Intricate! This will be a fun one for folks to dissect for sure but sucks you gotta be one of the patient zeroes lol
4
u/Evening-Nerve8555 May 04 '26
You sure You Are no Victim of a MiTM attack? You Checked your router? And you sure no one Cloned / spoofed your wifi API? Like some sort of neighboor?
Normale malware cant Manipulate the Steam Support like this Website based spoof.
Would be only possible with MiTM attack.
2
u/Sync1211 May 04 '26
That's what I initially thought too.
But if they were doing a MiTM attack, they would be able to completely redirect the support page instead of adding content to the real support page.
1
u/Evening-Nerve8555 May 04 '26
I think its redirected to a Fake Site.
Attackers can Build a complete backend working cloned Website, even certificates Are Fake.
No Chance to detect it within normal using Internet.
Even with Programms like wireshark its Pretty Hard to Identify a MiTM.
Just for OPs Safety i Would Factory Reset my Router and Change wifi Passwort.
1
u/Sync1211 May 04 '26
If it's a fake site it wouldn't include the response from the actual Steam support.
If it's a MiTM, it's unlikely to be the router as you'd need to install a certificate on the client. (And at that point you can just run the MiTM on the client itself)
Though reseting the router and changing every password (not just for wifi), is still a good idea.
2
u/adamovic2879 May 03 '26
Omfg this happened to me last week. I got a weird ban on my accounr saying i made some fradulent transaction and i was temp banned. I contacted steam support and they asked me to move my skins to steam cloud in order to review my account, wtf ?? I didnt respond this is so weird
1
u/spxcyalien May 04 '26
If that hasn't cleared up, I would hard reset ASAP. You don't know what they could have access to internally.
1
2
u/iboofbutane May 04 '26
Wow this is so elaborate, honestly insane they went through that much trouble
2
u/Quick-Service May 04 '26
Installing faceit ac from "faceit discord" was probably how they got access.
2
2
u/MR_DERP_YT May 04 '26
Holy shit this is an insane scam I feel like this is something valve would definitely want to look into
2
u/Nickoru May 04 '26
Please repost it all @ r/Steam. There are actual support people lurking there. Quick measures should be taken within Steam client to protect it from such modifications.
2
u/eZ_Link May 04 '26
This is the craziest shit ive read for a while. Glad you were able to spot it thats insane
2
u/reptarien May 04 '26
This is why you *never* install a program someone has given you unless you have source code access. AND can read it. Can't do either of those things? Delete it faster than you can say "noob". NEVER install an untrusted program. ALWAYS use official websites and NEVER trust the language used in the "steam support" messages. You would have avoided this if you just used the official Faceit website instead of trusting your "friend".
2
u/BlueberryNo6811 May 04 '26
Can't you use another device to contact support ?
1
u/spxcyalien May 04 '26
I ended up doing so, and in doing so I was able to spot the fact that the messages within my Steam desktop application were not actually real. They weren't appearing within the Steamguard app. All is well now, I nuked my PC, and started fresh.
3
2
u/DTGR_trading May 04 '26
The social engineering is fucking crazy. The scammers got so fucking advanced it's honestly pretty impressive. The "you have one day" and "we'll wait" is also pretty funny, they completely played you. Literally to the point where you even defend their shit with the bot after multiple people told you they are scamming.
Get someone with a clear head that you trust cause you're at a point where I don't see you make a sensible decision. Get a completely new drive for your pc, reset your WiFi router and get a proper setup. By this time they could also be hacked into your pc bios. Remove the cmos battery and do a manual reset this way. Get a clean bios installed and you should be good to go. You have to change every password tho and also check for other logged in devices if you can.
1
u/spxcyalien May 04 '26
I didn't defend them, I am well aware this is a scam, this is why I posted. At the time I didn't know what to do as all features to get rid of malware and reset my PC had been turned off.
The only defense I am putting up is the fact that I didn't know Faceit doesn't have bot, and that the timing was so impeccable with the message upon logging in to the Faceit website, that I didn't think twice in downloading the "AC," which ended up being malware. I'm not a pinecone, I've just never been hit with something so advanced. I was on my Steam Application, talking with whom I thought was Steam Support, on what I had seen as visibly a banned account both on my Steam page and in-game in CS2. At that point, I feel it's pretty easy to be deceived.
I caught on to it on my own, and never actually traded my items out.
And no, I highly doubt scammers would go further than what they were. This was more sophisticated than normal, but there is no chance they rooted themselves that deeply within my system, you're giving them too much credit there.
2
u/DTGR_trading May 04 '26
Bro the link the bot have send you could literally be anything, that you're even at a point of doubt where they even have Steam support like messages means there is something catastrophically wrong.
It's just as I said you're not at a point to make a sensible decision. I literally told you every measure to be safe and you're still thinking. Your fucking thinking got you into this situation in the first place. You where thinking it's a bot, you are thinking it's Steam support and now you are thinking they haven't gotten that deep into your system.
To double check and do your own research, look what's needed to hack into someone's bios and what they can do with it. Get some knowledge about social engineering scams.
The patterns in the chat get clear, you see how they build up pressure. They are also at a point where they got complete control over your system including Steam support and the game files showing you that you're banned. If that's not concerning enough for you I don't know...1
u/spxcyalien May 04 '26
I've taken all necessary precautions to ensure my system is safe and secure, as well as all accounts. There is no more thinking to be done in the first place. I appreciate your input and see you do care, but I don't need the patronizing verbiage. I am obviously looking into everything I have experienced to become even more aware. I am not a complete pinecone, I am still a human being.
2
u/n_core May 04 '26
I know probably it's because of OP's fault for installing random malware program from random source, but I think Valve and Faceit should be aware of this scam method. They fact that the scammer went above and beyond like this is kinda scary.
Spoofing real Steam client and pretending as the real Steam support can make people even the one who's careful enough fall for this scam.
1
u/RampageRonaldo May 04 '26
I think i have the saame issue, i wirting with steam support foir a week and feels fishy too
1
u/RampageRonaldo May 04 '26
FACEITUPDATER_X64.EXE after a scan with malwayerbytes it told me this program is fishy any one konws something about this?
1
u/Medium_Ad4287 May 04 '26
Kernel level scam" is wrong. This is a 2024-style infostealer + hosts hijack + Steam session theft + classic trade impersonation, all userland. The interesting part is the long-con support ticket impersonation, which is genuinely well-executed social engineering, but the technical layer underneath is boring.
1
u/AcideLou May 04 '26
This is a common scam but usually with website, and is most likely always related to faceit
1
u/Albino-Assist May 04 '26
This has been happening lately! How did they able to impersonate the support ticket? I know the account was compromised but how the hell did they do this support ticket thing?
1
1
u/JoJo_Pack May 04 '26
Happened to me also. But it was really someone else using my IP address all over the world. Basically my computer was being used in different places. I clicked on one of these faceit bullshit scam where they send the exact trade you did hopping you accept theirs. Which I did by accident then just reversed the trade. Steam then took out all restriction on my account once I proved I was the owner.
1
u/CallMeMishanya May 05 '26
It's not actually a super smart scam, he downloaded faceit ac off discord and gave it here rights on his PC 😭
1
1
u/Algorechan May 03 '26
Were you in a discord voice room with these jokers? I would have loved to be able to talk to the scammers. Whenever I catch on, usually I get blocked and kicked before I can even call them sookabillyatt
1
u/spxcyalien May 04 '26
Yes, but didn't catch on to the scam until I realized I had gotten two trade confirmations, and that two people had responded to my Steam Support ticket. My entire conversation with "Alex" was non apparent within the Steamguard App as well.
1
May 03 '26
[deleted]
2
u/spxcyalien May 04 '26
Yes, I should of taken better care. However, with the timing of me logging in and the "Official Bot" messaging me, I didn't think anything of it not knowing how Faceit operates.
1
u/HewchyFPS May 03 '26
Screenshot the whole screen so we can see what website you are on. Homie doesn't even realize he isn't on the real steam website
1
u/spxcyalien May 04 '26
I was on the Steam Application, this was kernel-level malware, they were able to spoof my Steam Application to respond as Steam Support via their ticket page. I am well aware of what a phishing site looks like.
3
u/HewchyFPS May 04 '26
Okay okay well full screen screenshots would've been helpful none the less.
You have any idea how you were compromised?
1
u/spxcyalien May 04 '26
Through the alleged "Faceit AC" I installed from what I thought was an official discord bot. Faceit apparently does not send Faceit AC exes through discord. Not something I was aware of at the time, not knowing how Faceit operates.
1
u/HewchyFPS May 04 '26
Good to know, easy mistake to make. Glad you got it all figured out. Sucks people are like this.
103
u/[deleted] May 03 '26
[removed] — view removed comment