Malware News Steam Session Hijacking Malware via MITM Proxy and CEF Debugger Abuse

[Khushal]

Content source

https://x.com/rifteyy/status/2091867977817719235

Threat Summary: Steam Session Hijacking Malware via MITM Proxy and CEF Debugger Abuse
Source: Independent security researcher. Discovered during active malware removal.

---

Overview
A malware strain targeting Steam users was identified during a malware removal engagement. It intercepts Steam's network traffic and patches the Steam client window in real time, presenting a convincing fake suspension notice designed to coerce the victim into interacting with an attacker-controlled account. The deception is visually indistinguishable from a legitimate Steam UI event. Internal comments and changelog artifacts within the malware suggest it was developed using AI-assisted tooling.

---

Technical Mechanism
The malware installs mitmproxy, plants a trusted certificate into the system store, and redirects local traffic to 127.0.0.1:8888. Steam is forced to launch with the -cef-enable-debugging argument, allowing the malware to attach as a debugger to Steam's Chromium Embedded Framework (CEF) process. Steam cannot start without the malware debugger present. Through this attachment, the malware reads active session tokens, inventory and account status data, intercepts and logs network requests, and patches the Steam window DOM in real time.

---

Persistence and Defense Evasion
Persistence is achieved via a VBS script executing on every startup. The malware adds Windows Defender exclusions, disables Defender entirely, and disables Smart App Control (SAC).

---

C2 Telemetry
On each execution, an extended information beacon is transmitted to attacker-controlled C2 infrastructure, along with a maintained log of all intercepted Steam requests.

---

Victim-Reported Symptoms
The victim reported inability to launch games, intermittent login failures, repeated unsolicited blocking of friends, and unauthorized profile picture changes. All anomalous UI elements appeared authentic due to real-time window patching.

---

Remediation
Full remediation was achieved; the victim regained normal Steam login and gameplay functionality.

---

Indicators of Compromise

Type	Value
IP Address	23.145.248.106
Domain	supchat[.]lol
SHA-256	a4ebfbf6c0d932bc13f8d1f1f74dcd08b3e92036c6d7936b1dbd9c2998c077d3
SHA-256	82685abd251e0547cb4bd2e4f95b70481dcdbae8ec70399ebe45e73b15e36652
SHA-256	081531b8c7f808d54eb1e313acb12ed6fd18b470b838c0e4d24201057b95abac
SHA-256	c8abe758ccee10d8b10fb6aad78fd8729eb843674518da82a7bf93597d03173a

VirusTotal detections available for all IoCs.

 

[Bot]

Assessment

This describes a serious local compromise involving credential/session theft, traffic interception, persistence, and security-control tampering. However, the report alone does not allow me to independently verify the malware family, the C2 infrastructure, or whether all listed IOCs belong to one campaign.

The technical chain is plausible: a locally trusted proxy certificate can enable HTTPS interception, while CEF debugging could expose Steam-rendered content and session-related data. The exact information obtainable would depend on Steam’s implementation and the malware’s code, so those details should be supported by captured logs, process data, or reverse-engineering evidence rather than assumed.

Important post-remediation actions

If this incident is genuine, remediation should include more than removing the files:

• From a known-clean device, change the Steam password and the password of the associated email account.
• Use Steam’s account security controls to deauthorize other devices and review recent login activity.
• Regenerate or revoke any Steam Web API keys and review trade, market, inventory, friend, profile, and account-history activity.
• Contact Steam Support if unauthorized trades, purchases, inventory changes, or account restrictions occurred.
• Remove the malicious root certificate, proxy configuration, Defender exclusions, startup VBS entries, scheduled tasks, services, and modified Steam launch parameters.
• Verify that Microsoft Defender, Smart App Control where supported, Windows Firewall, and security notifications have been restored to their intended settings.
• Check Steam shortcuts, launch options, and installed files. Remove unexpected debugging arguments and use Steam’s file-integrity verification afterward.
• Inspect other accounts used on the affected computer, especially email, browser sessions, password managers, Discord, and gaming platforms.

Session theft can remain effective even after a password change, so revoking active sessions and reviewing account activity is particularly important.

IOC handling

The IP address, domain, and hashes should be treated as indicators for investigation, not as a complete detection rule. Infrastructure can be shared or reassigned, and a hash identifies only one exact file. A useful report would include the VirusTotal report URLs or IDs, file names and paths, certificate fingerprints, proxy settings, persistence locations, Defender exclusion paths, process command lines, and relevant network timestamps.

Do not visit the listed domain or execute any associated samples for testing. Submit samples only through a controlled malware-analysis process, and remember that public VirusTotal submissions may expose the sample to security researchers and may not be appropriate for confidential files.

Conclusion

The described behavior warrants treating the affected system and Steam account as compromised until session revocation, credential changes, persistence removal, and security-control restoration have been confirmed. Any remaining uncertainty should be resolved with forensic evidence and additional community analysis rather than inferred solely from the symptom list.

 

[TairikuOkami]

.lol

One of the advantages blocking TLDs that you will never ever use.

The malware installs mitmproxy, plants a trusted certificate into the system store, and redirects local traffic to 127.0.0.1:8888

Blocking unused TCP ports will do, but generally any firewall should notify about it.

Persistence is achieved via a VBS script executing on every startup.

VBS is already deprecated in 11, but still disabling or restricting it is essential.
Startup entries are monitored and clearing them upon shutdown also helps.

Thanks for heads up, Steam CEF browser is already insecure and outdated as it is, so I have restricted it even further.

netsh advfirewall firewall add rule name="Steam TCP Block" dir=out action=block protocol=TCP remoteport=1-442,444-65535 program="E:\Steam\bin\cef\cef.win64\steamwebhelper.exe"
netsh advfirewall firewall add rule name="Steam UDP Block" dir=out action=block protocol=UDP program="E:\Steam\bin\cef\cef.win64\steamwebhelper.exe"