Author Topic: well it looks like I found a new scamming attempt from bots (Steam)  (Read 4289 times)

i like to add bots to actually see if they're real

this one wasn't



i checked the URL and replaced it, it didn't work
why?
the id is way too loving long

anyways i opened it up in a new window and this is what appeared



The best trader, eh? that's it?

note that if you go to the page everything you hover over will take you to the login page without even showing the real URL



slight difference in URL:

real

fake



this does nothing but OK



the file known as SteamGuard.exe is downloaded
2 things:
1. steam/valve would never require you to download a file. everyone knows you get a code from your email. this is never done nor will be done.
2. if you're this stupid to proceed beyond this point you're a cigarette
oh and a final third thing:
spelling errors. if you don't see these right away you also deserve to get scammed the forget out of you and infected

after looking at code i noticed they were leeching off of steamnetwork js files and other resources
linked sites include other things, but also ruseller.com. even though the rating is green on mywot, various reports of scams and malware are reported.

errors
Uncaught TypeError: undefined is not a function
Uncaught TypeError: undefined is not a function

also appeared

i'll update this when I actually get the file launched in a VM

Quote
i'll update this when I actually get the file launched in a VM
Uh, Why?

This isn't a new thing at all.

Don't download it or run it unless you have a separate re-formattable computer, I've heard of certain viruses can tell when they are on a VM. your computer isn't guaranteed to be safe with one.

i admire the dedication to the scam but jesus christ



steamcommyuti

jesus lol


what's this

spose to be where I get my various emoticons

how could you not notice -yuti at the end of the address, it sticks out more than a camel toe.

"Kick ass" bookmark
11/10

Jesus christ. Why do people think that scam bots work?

commyuti?
cmomusint scmaming cofnimred!111!1!!!11!!

These have been around for at least a month, I don't really think a detailed investigation is necessary, just yet another guy phishing accounts

Report the account and move on

i remembered a actual human player tried to send me one of these.
it linked to stearncommunity

the guy, to my suprise, actually asked if i had added his friend yet.

i responded with "not yet i'm trying to log into steaRncommunity."

i think he removed me afterwards lol

The exe, when run scans your pooter for the SSH (or SSHH) file, can't remember which then uploads it, this file is then used by the phishers to bypass the logging in verification.