Fake verification pages are stealing Steam accounts from players

Malwarebytes warns of a phishing campaign targeting FACEIT (CS2) players where attackers host convincing fake verification pages and use a Browser-in-the-Browser fake Steam login to capture usernames, passwords, and Steam Guard codes; the scam uses lookalike domains and a deliberately blurry QR code to push victims toward the credential-stealing flow, enabling theft of games, skins, wallet funds, and account resale. Recommended mitigations include verifying the browser's real address bar, avoiding links, enabling Steam Guard, changing reused passwords, reviewing account activity, and using browser-based phishing protection.