According to a tweet by security researcher nullcookies, a fake site Steamthat supposedly offers skins through giveaways. In reality, login credentials victims'
The phishing site was discovered by researcher nullcookies.
These phishing Steam sites usually appear directly on Steam. Hackers display messages on Steam profiles that say: “Dear winner! Your SteamID has been selected as the winner of the weekly giveaway. Get Karambit | Doppler at giveavvay.com.”
If the user opens the link, they will be taken to a site that informs them about their gift. The phishing site also features a fake chat screen on the left side of the page.
To get the free skins, the user will need to log in to the site using Steam credentials . Then, they will need to wait for the words “SKIN RAIN” in the chat. When the words appear, the site tells the user to click on the words in order to receive one of the free skins.
Meanwhile, the chat messages that appear on the site are also fake. They do not come from real visitors. Instead, the hackers use a JavaScript script, which contains various phrases that are randomly selected and inserted into the conversation, to make it look like a normal conversation.
If a user falls for the trap and clicks on “Sign in via Steam”, they will be taken to a supposed Steam login form, which is actually fake. Users cannot detect the scam because the page looks very similar to the official Steam page. So they enter their credentials and these are transferred to the hackers.
In this way, hackers gain access to the victim's credentials, hack into the account , and are able to perform various malicious activities.
The good news is that the phishing site is hosted on Cloudflare , which means that users will receive a notificationif they try to access the phishing site.
Users should avoid connecting to the site from unknown sources. They should connect directly from the steampowered.com domain to ensure that their credentials don't end up with scammers.
