Fake Steam Desktop Authenticator steals account details
ID: 6a8e5dfe-6a8d-50f2-9230-49404dcb9aa0
STIX ID: report--6a8e5dfe-6a8d-50f2-9230-49404dcb9aa0
Feed Name: Blaze's Security Blog
This report details two malicious clones of Steam Desktop Authenticator: a trojanized executable from steamdesktopauthenticator.com that exfiltrates Steam credentials to steamdesktopauthenticator.com and steamdesktop.com (MD5: 872abdc5cf5063098c87d30a8fcd8414), and a GitHub fork that intercepts trades/market actions via lightalex.ru (hosted at 91.227.16.31, previously linked to SteamStealer sites cs-strike.ru and csgo-knives.net). The author recommends deleting the fake apps (no persistence observed), scanning with antivirus, deauthorizing other devices, changing the Steam password, enabling Steam Guard, and only downloading SDA from the official GitHub repository.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.