A new phishing scam tries to trick gamers on the Steam online video game platform into divulging their passwords — and it does so by masquerading as Steam’s own security measures and tricking users into disabling the Steam app’s built-in protection.
Steam lets users enable an extra security setting beyond just a username and password. Called Steam Guard, this extra step requires users to enter a randomly-generated code sent to their Steam-registered email addresses before they can access their accounts. That significantly increases users’ security, but it also means they’re used to receiving Steam account emails.
MORE: 10 Steam Games Under $10
Steam Guard also lets users designate certain computers as always-authorized, so when they log in on that computer, Steam Guard won’t prompt them for an emailed code.
Now security firm Malwarebytes reports that scammers have crafted official-looking Steam login pages that prompt users to enter their usernames and passwords. These pages are just “phishing,” or using bait to trick users into compromising themselves.
In the usual Steam sign-in process, users would then have to enter the emailed code generated by Steam Guard. However, the scam website then asks users to upload a file from the Steam folder on their computer called a SSFN file. This file is what authorizes your computer to Steam Guard; it essentially tells Steam Guard not to demand an emailed code.
If you upload your SSFN file, the scammers can then use it, along with the phished usernames and passwords, to access your Steam account. Once inside, the scammers can drain the account’s credit as well as its virtual items and trading cards that Steam users can collect and trade. However, the scammers can’t buy more video games from Steam’s online store, since that would require knowing your credit card information.
Game industry blog Gamasutra says they’ve only seen this scam at play in the past few weeks. Steam users should double-check that the URLs of the pages they’re on are legitimate and never upload their SSFN files.
Email jscharr@techmedianetwork.com or follow her @JillScharr and Google+. Follow us @TomsGuide, on Facebook and on Google+.