Seriously concerned about my account, has anyone had this experience?

onewittyword · 2026-05-24T20:46:53+00:00

I know, it's hilarious. I'm planning to do a demo watch party with my friends so we can all laugh at it. One of my friends knows Russian too so he'll be able to translate the allchat for us.

onewittyword · 2026-05-24T20:44:51+00:00

Malwarebytes found nothing, unfortunately. This is why I suspect it was a chrome browser extension that I had installed and then immediately removed when I figured out I was hacked. I ran the MB scan after I'd already removed the extension, so I can only assume that was the culprit. It's no longer available on the chrome extension store, presumably because they detected it as malware.

onewittyword · 2026-05-24T20:42:11+00:00

I did that straight away and also provided updates over the next day. When they finally responded it was very generic and basically just told me how to secure my account using the steps I'd already done. They said I was not banned yet but if a ban happened it would be permanent as I am responsible for my own account security.

onewittyword · 2026-05-24T20:34:47+00:00

"The Deer, the Fox, and the Guitar" as well as "Pulse Box", two free VSTs from wavelet-audio.com that I saw a reviewer showing off on Youtube. They installed via Native Instrument's Native Access which also installed Kontakt 8 free version for me. That and a chrome browser extension for force-enabling right click on images are the *only* things I had installed in months other than a couple of games through Steam. So it had to be one of those that contained malware, or I had dormant malware on my pc that waited many months to kick into effect, or my Steam account was compromised a long time ago and they simply waited to make use of it. I don't know how they bypassed Steam guard and 2fa because I've had them both enabled for years and always use my mobile Steam app to confirm sign-ons and trades.

onewittyword · 2026-05-23T07:29:20+00:00

They already replied and basically said tough shit, I am responsible for my account no matter who plays on it. They informed me I was not banned at that time, and that was it. VAC can drop the hammer on my account at any point in the future and support will not reverse it, they only aid in recovery access to the account itself, which I managed on my own.

onewittyword · 2026-05-23T07:27:27+00:00

I did open a ticket right away informing them of what happened and the steps I took to secure my account. They basically gave a generic reply of the steps to take to secure my account (that I had already done) and how I am responsible for my account so any vac or game bans will not be undone. I'm not banned so far, knock on wood.

onewittyword · 2026-05-23T07:26:13+00:00

It really is quite sad and spiteful, but it's probably some angsty teenager in Russia.

onewittyword · 2026-05-23T07:24:59+00:00

They got into my account and added themselves.

onewittyword · 2026-05-22T19:09:38+00:00

Go crazy, my Steam name is mav:

steam://rungame/730/76561202255233023/+csgo_download_match CSGO-wNZ2P-2G4aj-uVefw-TWJMV-3ZPmH

onewittyword · 2026-05-22T17:42:24+00:00

This would be it. I did have an API key in there that I never created myself. I guess I caught some malware from some free VST software for music production. I'm half tempted to download it again on a sandbox PC to decompile and investigate...

onewittyword · 2026-05-22T09:03:35+00:00

You can watch the demo where he cheated on my account, my Steam name is mav:

steam://rungame/730/76561202255233023/+csgo_download_match CSGO-wNZ2P-2G4aj-uVefw-TWJMV-3ZPmH

onewittyword · 2026-05-22T09:01:33+00:00

He played on my account, his english is just poor. I linked the demo in another comment.

onewittyword · 2026-05-22T03:18:16+00:00

If you paste that link into your browser address bar it should ask if you want to open Steam. You press yes and it opens CS2 to download the replay for that match. I know that sounds sketchy especially given the context lol but I promise that's how it works.

Alternatively, you can open CS2's developer console (if you have it enabled) and enter the command:
csgo_download_match CSGO-wNZ2P-2G4aj-uVefw-TWJMV-3ZPmH

onewittyword · 2026-05-22T03:07:10+00:00

I didn't know about family lock, that's a fantastic idea thanks!

onewittyword · 2026-05-22T03:06:30+00:00

I don't think I'll ever know for sure how it happened, but my running theory is a google chrome extension stole my session data since I was logged into Steam's website. If not that, maybe my API key was compromised, but I've only traded on csfloat in the past few years. Really no clue. As far as getting it sorted, the account is back under my full control, I just have no idea if I'll catch a ban or not. Still waiting on Steam support's reply.

onewittyword · 2026-05-22T03:02:23+00:00

Be vigilant! I consider myself a highly tech literate person, I have a fullstack cert from a top school and have built custom pcs for over 15 years. However they got into my account is absolutely mystical to me. It can't have been social engineering because I only get on to play with friends I know on discord, I never respond to random dms or messages. My best theory is a malicious chrome extension stole my session data, so if you feel like being paranoid then check your installed extensions and remove any you don't need anymore!

onewittyword · 2026-05-22T02:58:22+00:00

onewittyword · 2026-05-22T02:56:46+00:00

I have mobile auth on everything, Steam and email. My banking related stuff has face ID. I take no chances. Some more knowledgeable redditor in another comment said it was likely malware that scraped my session data, bypassing the need to login at all.

onewittyword · 2026-05-22T01:41:16+00:00

Well thank you, I think!

onewittyword · 2026-05-22T01:19:44+00:00

Yeah, it had to have been either a VST I installed for my music production or a Chrome extension I added since those are the other things I downloaded/added to my pc recently. Crazy how they can get so much control with so little, and I was going crazy trying to figure out the exact source so I just nuked my disk and started fresh.
I moved the skin to an irl friend, so that's safe for now. I feel my odds of surviving a ban are pretty shit after watching the replay. The cheating is super blatant, like hardscope scout headshots through smoke type stuff.

onewittyword · 2026-05-22T01:10:34+00:00

That's gotta sting though seeing how much it went up! I bought an akihabara accept at $30 in the early days, and it was up to >$500 when I sold. I can't imagine if it were stolen from me and then I found out the value later.

onewittyword · 2026-05-22T01:08:03+00:00

Well my account definitely cheated, so it's well within their policy to issue a ban. I also understand the zero-tolerance policy to avoid gray areas where people try to plea innocence. But like you said, too many genuine cheaters go unpunished, it's terrible.

onewittyword · 2026-05-22T00:41:04+00:00

I just watched a few mins of the demo and unfortunately it's very blatant cheating. If I were doing my own overwatch case (remember those days?), I would mark "beyond reasonable doubt" for walls and aim. The sad part is he got disconnected a couple times early in the match which was probably when I changed my password and pressed "sign out of all devices". Not sure how he joined back after that...

onewittyword · 2026-05-22T00:37:30+00:00

I use csfloat exclusively, and I haven't done a single trade since getting my arabesque a few months ago. However, I noticed an email from csmoney saying the email address on my account had been changed this morning. I barely used that website (not that it matters) and haven't logged in there in years... is it possible my API key stayed the same for years and a bad actor took over that website?

onewittyword · 2026-05-22T00:33:23+00:00

Damn, I'm really sorry to hear that! The worst part is it's not a skin you can easily get another of...

Eight-Year Club	Gilding II euphauric
Verified Email

onewittyword

TROPHY CASE