Be Warned Steam Users: SteamGuard.exe will hijack your account!

[SkyboundSteven]

One line summary:
BE WARNED: SteamGuard.exe is NOT from Valve or Steam! Real Steam login doesn't ask you to download something to finish login!

I got a message from a user, saying they want to trade an item. Here's the message:
[unassigned]: Hi dude, my friend wanna trade his DC Hook and keys for some of your items, but he has some error if u interested to trade, add him : =» fake://stemmcommunity.com/id/TheRedPro «=

Though that might look like real link and the user had made a typo, here's the screenshot:

They even used same top bar.

When I tried to log in, this popped up and downloaded SteamGuard.exe:

No matter what you type, same popup will appear.
Here, I typed "MalwareTips" on username and "aaaaaaaaaaa" on password, which doesn't exist, and it still gives same screen.

BE WARNED: SteamGuard.exe is NOT from Valve or Steam!
I can't stress this enough:
Real Steam login doesn't ask you to download something to finish login!
I warned you: It's fake! You should NEVER try to go to link from stranger!
Although Steam URL Filter failed to catch this one, I almost got phished and WOW64 error saved me.
If it was successfully run, my lovely account will be gone forever and my items will be gone too.

Here's a link to its description: http://lmgtfy.com/?q=SteamGuard.exe

If you want, here's the link to the malicious file:

����://mega.co.nz/#!Rg52kaIS!pgFEk8DmZMYnClEQwfQMtqP8jnJdiZoeP5PAvFDdGaM

It will say Valve Corporation made it, but look:
"steamcmd (buildbot_steam-rel-win32-builder_steam_rel_client_win32@steam-rel-win32-builder)"!
You smell something fishy here, right?
Even it says "Steam Client Bootstrapper" and "Copyright(C) 2010 Valve Corporation".
It's fake. Real one should not say anything like that!

 

[SkyboundSteven]

And yep, at the time of phishing, I typed wrong password too. That saved me from getting my account hijacked from informations I typed on that webpage.

 

[Malware1]

Thanks, you should post it in Malware Hub too

 

[SkyboundSteven]

Thanks, you should post it in Malware Hub too

If you could, please, PLEASE let more users know about this. I can't stand seeing the guy who did this getting huge mass of money from helpless gamers.

 

[Malware1]

If you could, please, PLEASE let more users know about this. I can't stand seeing the guy who did this getting huge mass of money from helpless gamers.

what can I do ?

 

[SkyboundSteven]

The phisher's Steam profile reported and the page was sent to Spamhaus.

 

[xxtoss23]

thanks for the warning i am steam user to

 

[SkyboundSteven]

what can I do ?

Tell everyone you know (and are using Steam) about this, and tell them to NEVER trust any Not-Steam-Certified sites related to Steam, and tell them to use Netcraft toolbar, then if ISP is NOT "Akamai Technologies INC." tell them to leave the page immediately.

 

[SkyboundSteven]

thanks for the warning i am steam user to

Glad that I helped. Make sure to tell your fellows about this!

 

[SkyboundSteven]

Also...NEVER TURN YOUR BACK ON any site.
Malwares can alter your configuration to redirect you to fake page.

For example, Steam Powered can be redirected to Staem Powered, Google can be redirected to Googie, Yahoo can be redirected to Yehoo, etc.

 

[Manzai]

Thanks for the warning

 

[SkyboundSteven]

Thanks for the warning

Tell everyone you have on Friends list about this! (if possible)

 

[SkyboundSteven]

Success!
Netcraft now blocks this site!

 

[Deleted member 21043]

Spoiler: A mistake they may have made lol

If the authors were really stupid they would have weak security on the application, which means if they used it to login to they're email and store all the logins the .exe could be analysed, decompiled, injected... Whatever, to retreive the login credentials to the email account they are using to receive the information. This means anyone daring who is against they're actions could log themselves into the account storing people's login, and clear the inbox/deleted/folders. Then, afterwards, change the password and recovery, then shutdown the account. Job done, there is no more spreading phising scam because the email won't exist anymore to be used or access information... If it's in .NET you could easily use MSIL decompiling too to get the email, then report it for abuse of scamming/phising/malware attack.

 

[SkyboundSteven]

Spoiler: A mistake they may have made lol

If the authors were really stupid they would have weak security on the application, which means if they used it to login to they're email and store all the logins the .exe could be analysed, decompiled, injected... Whatever, to retreive the login credentials to the email account they are using to receive the information. This means anyone daring who is against they're actions could log themselves into the account storing people's login, and clear the inbox/deleted/folders. Then, afterwards, change the password and recovery, then shutdown the account. Job done, there is no more spreading phising scam because the email won't exist anymore to be used or access information... If it's in .NET you could easily use MSIL decompiling too to get the email, then report it for abuse of scamming/phising/malware attack.

I am currently probing the site.

 

[Aura]

Just to say that these phishing pages and SteamGuard.exe have been going around for months now, if not a year. And it will probably take quite sometime before it starts "dying" too.

 

[SkyboundSteven]

UPDATE: NEW MALICIOUS LINK

malicious://steamcommunniuty.com/profiles/76561197977828464

 

[CRYLLEZZ]

C'Mon GUYS the url is so FAKEEEE!!!! They cannot phish you unless URL is not steamcommunity.com

 

[SkyboundSteven]

C'Mon GUYS the url is so FAKEEEE!!!! They cannot phish you unless URL is not steamcommunity.com

And if you are not careful enough.

 

[Hello]

UPDATE: NEW MALICIOUS LINK

malicious://steamcommunniuty.com/profiles/76561197977828464

http://i.#####ed.the.cat/nwynbpk.png
The nice things seem to be sent to 82.146.53.11
There's a mention of wrrrz_desktop.com (the domain does not exist).
http://i.#####ed.the.cat/fenouon.png

Googling "wrrrz" shows this thread at youhack.ru made by an user called "Wrrrz" about selling CSGO knives: http://youhack.ru/showthread.php?t=467841&attempt=1