Threat Vector Matrix: Tournament Hub Phishing vs Legitimate Platform OAuth
Competitive Counter-Strike 2 players frequently receive messages from friends or casual acquaintances asking them to "vote for our team" or "stand in for a tournament match." This attack leverages counterfeit browser windows and malicious OpenID / OAuth delegation.
| Attack Vector / Step | Counterfeit Phishing Mechanics | Legitimate Platform Behavior | Threat Severity / Risk Level |
|---|---|---|---|
| Initial Contact | Compromised friend account sends Steam/Discord DM link | Official tournament invitations occur within in-app hubs | Critical: Social engineering exploit |
| Landing Page | Cloned FACEIT/ChallengerMode UI with working buttons | Real platform domain with verified SSL certificate | High: Visual spoofing |
| Steam Login Prompt | Fake pop-up window drawn in HTML/CSS (Browser-in-the-Browser) | Real pop-up window draggable outside parent browser bounds | Critical: Credential harvesting |
| Two-Factor Authentication | Requests Steam Guard Mobile Authenticator code or QR code | Legitimate OpenID never asks for a 2FA code if already logged in | Critical: Session token interception |
| Post-Exploitation Action | Generates Steam Web API key to hijack incoming trade offers | No external tournament requires persistent trading API access | Account Compromised: Silent trade manipulation |
Identifying the Browser-in-the-Browser (BitB) Attack
Attackers embed a fake Chromium window inside the phishing page that simulates a legitimate URL bar:
- Draggability Verification:
Attempt to drag the Steam login window partially outside the boundaries of your physical web browser window.
- If the login box cannot cross the border of the webpage, it is an HTML element (BitB Phishing Attack).
- A legitimate login window is an independent OS window that moves anywhere across monitors.
- URL Address Bar Interaction:
Attempt to highlight or right-click text inside the supposed address bar (
https://steamcommunity.com/openid/login...).- If the address bar text cannot be typed into or displays image artifacts, close the tab immediately.
- Session State Invariance: If you are already logged into Steam in your primary browser, a genuine OpenID page simply shows your avatar and a green Sign In button without prompting for passwords or 2FA codes.
Emergency Containment and Session Revocation Protocol
If you entered credentials or scanned a QR code on a suspicious hub, execute this containment sequence immediately:
// Script to verify network hosts file integrity against domain redirection
$HostsPath = "C:\Windows\System32\drivers\etc\hosts"
$SuspiciousEntries = Get-Content $HostsPath | Where-Object { $_ -match "steam" -or $_ -match "faceit" }
if ($SuspiciousEntries) {
Write-Warning "Suspicious redirect entries found in hosts file:"
$SuspiciousEntries
} else {
Write-Host "Windows hosts file clean of unauthorized game redirections." -ForegroundColor Green
}
- Revoke Steam Web API Keys:
Navigate directly to the official Steam Web API management portal:
If a domain name is registered and you did not explicitly set it up for development, click Revoke My Steam Web API Key immediately.https://steamcommunity.com/dev/apikey - Deauthorize All Active Devices: Open Steam Desktop -> Settings -> Security -> Click Deauthorize all devices. This immediately invalidates all active session tokens and kicks attackers out.
- Reset Steam Password: Changing your password issues new cryptographic tokens and resets trade validation secrets.
- Generate New Trade URL: Go to your Steam Inventory -> Trade Offers -> Who can send me Trade Offers? -> Create a new Trade URL to invalidate intercepted links.