NEW STEAM ACCOUNT PHISHING METHOD DISCOVERED

[Poohy14]

 

sorry if this is a repost

 

Source: Bright Side of News

[Lord Pantaloons]

tricky stuff, glad you posted it

[LOLPhilips]

Yarrrrr,

Thanks for the heads-up matey

[Raboo]

Thanks for posting this.

[Infernal Burrito]

This is old news...

[dlf]

Earlier today I checked my wishlist and the site was in Spanish. Changed my password, the site and the client interface to something else.

[ColorfulShardMC]

What's up with the double mm? i mean steammcommunity?

[91wow]

What's up with the double mm? i mean steammcommunity?

communuty*

[Poohy14]

What's up with the double mm? i mean steammcommunity?

 

 

never noticed that before until now

[ColorfulShardMC]

Also the _ after browse

[AMICLG]

Repost but many people seem to not know about it so I'd rather have 5 repost than people being unsecure.

[kamiyo]

".../logins/home/"

 

Tons of red flags in the URL. Thought the biggest red flag should be the fact that you need to upload a file.

I don't know if this is a repost but I've seen this somewhere before, I just don't quite remember where.

Still good stuff to spread around though.

[Askew]

After seeing the URL I wouldn't bother reading anything else at that address.

[catbutts]

lol "click this link, try to sign in, and now upload this obscure file you didn't know existed"

Are phishers even trying anymore? And if people still fall for it, what does it say about them?

 

edit: An easy fix for Steam would be to rename that file to "hey don't share this" in case anyone tries to find the file and upload it. Along with any option for 2-step verification, companies should be educating people on how it works and why you should be receiving a notification on your phone or email instead of being redirected to a new site. I am assuming many people aren't told how one time/app specific/authenticator passwords work. As long as they don't know, they are still vulnerable.

[Kamina]

Just look for the identity verification on the URL. This should be a security measure everyone should follow with any service.

[silberdrachi]

Just look for the identity verification on the URL. This should be a security measure everything should follow with any service.

 

Lots of browsers have addons now to tell you youre putting data into non-HTTPS sites, and using stuff like HTTPS-Everywhere helps a lot too.

 

Best part about browsers now days is that for every thing that someone has thought of, there is a counter addon somewhere.

 

Though nothing beats just plain common sense. Any time you submit data to ANY site, check the url, check the HTTPS status, and think twice if they actually need that data.

[Mauri]

Are the people dumb enough to fall for this smart enough to find their steam folder?

[wilbso]

This scared the crap out of me when I read it, because 2 days ago I just added a new browser to my account (well, it didn't work, it just kept loading and did nothing) but it didn't ask me to upload any file. Phew.

Plus it was the legit website.

How are people getting that link though?

[brownninja97]

This is old news...

True for most of us but im sure it will be new to some people here, the more that people know the better.

[brownninja97]

I will just look for the https, if its not there then im not going on the site.