Free game giveaway scam targets Steam accounts

• Once users enter promo codes into the fake free game giveaway site, scammers hack their Steam accounts, take control over the accounts, and then target victims’ friends by sending the URL of the scam site via messages.
• This leads to a repeated cycle of promotion for the scam site through hacked accounts.

What is the matter?

Scammers are hacking Steam accounts via free game giveaway site that claims to offer free Steam game by entering a promo code on the site.

How does this scam work?

Once users enter promo codes into the fake free game giveaway site, scammers hack their Steam accounts, take control over the accounts, and then target victims’ friends by sending the URL of the scam site via messages.

• When users click the URL, they will be redirected to the scam site.
• Once users click on the Roll button, the scam site will pretend to select a random game from a list of popular ones such PUBG, CSGO, Tropico 4, ARK: Survival Evolved, Assassin's Creed, and more.
• It will then display part of a Steam promo code and prompts users to log in to their Steam accounts to claim free games.
• Upon logging in to Steam accounts by entering the credentials, the scam site will use the entered credentials in the background to login to users Steam accounts.
• The scam site also asks the user for a code to bypass 2-factor authentication and gain control over the user account.
• If users provide the code, the scam site will then perform an automated attack that logins to their account, resets the password, the associated email address, and the associated phone number.

This leads to a repeated cycle of promotion for the scam site through hacked accounts.

What should you do?

• When a user has their email address changed, Steam will send a notification to the user’s original email address that includes the country and address of the person who made the change.
• In that case, impacted users can open an account recovery support ticket and Steam will help in recovering the hacked account.
• However, if the scammers steal or trade away the items in your inventory, Steam's Item Restoration Policy states that they will not restore any lost items.

BleepingComputer tested this scam site with a Steam account. Upon entering the account login credentials, the scam site logged in to the account and changed the account’s associated email address.