Remote Access Scams vs Legitimate Platform Checks
| Inspection Scenario | Software Demanded | Attacker Motivation | Genuine League/Platform Standard | Risk Rating |
|---|---|---|---|---|
| Esports Qualifier Check | AnyDesk, RustDesk, TeamViewer | Harvest session cookies, Steam Guard tokens, crypto keys | Server-side demo review, kernel anti-cheat telemetries | Extreme (Immediate Total Breach) |
| "Illegal Trading" Investigation | Quick Assist, UltraViewer | Steal inventory via browser session while victim is watching | Platforms NEVER use remote control; all disputes are in-ticket | Extreme |
| "Screen Share" Screen Lock | AnyDesk (with mouse input enabled) | Black out screen using privacy mode while transferring skins | Pure screen broadcast via Discord/Twitch does not grant control | Critical |
| Unofficial Discord Tournaments | Download custom .bat or screen viewer | Execute infostealer malware (RedLine, Vidar) | Standard lobby invites without external binary downloads | Extreme |
Remote desktop software (such as AnyDesk, TeamViewer, and RustDesk) provides full unattended or interactive control over a host computer. Cybercriminals targeting competitive gamers and traders impersonate tournament organizers or discord administrators, demanding remote access under the pretext of 'anti-cheat PC checks' or 'anti-smurf inspections.' Once granted, attackers extract browser authentication cookies, steal local game credentials, or blackout the screen to trade away inventories.
Attack Vectors and Exploitation Techniques
- Session Cookie and Local State Hijacking:
- Attackers do not need your plaintext password or Steam Guard mobile authenticator code.
- Once connected, they script a command to copy browser profile folders (
Default\Network\Cookiesin Chromium browsers) or Steam config files (loginusers.vdfandssfnauthorization tokens).
- Screen Blanking and Mouse Lock:
- In AnyDesk, attackers activate 'Privacy Mode' (turning the host monitor black) and disable local mouse/keyboard input. While the victim assumes the PC is rebooting or calibrating, automated macros accept trade offers and confirm mobile authenticators.
- PowerShell Staging:
- The scammer pastes a seemingly innocuous diagnostic command into Run (
Win + R) or PowerShell, which downloads a base64-encoded infostealer directly into memory.
- The scammer pastes a seemingly innocuous diagnostic command into Run (
Immediate Incident Containment Protocol
If you have granted remote access or suspect an active breach, execute this emergency sequence immediately:
- Sever Physical Network Connection:
- Immediately disconnect the Ethernet cable or power off your Wi-Fi router. Do not attempt graceful software disconnects inside the remote tool window.
- Revoke Active Remote Software:
- Boot into Windows Safe Mode with Networking disabled.
- Uninstall the remote access software via PowerShell:
Get-Process -Name "AnyDesk", "TeamViewer", "RustDesk" | Stop-Process -Force
- Deauthorize All Active Platform Sessions:
- Using an uncompromised secondary device (e.g., your smartphone via cellular data):
- Steam: Go to Settings -> Manage Steam Guard -> Deauthorize all other devices. Change password and revoke API Keys at
steamcommunity.com/dev/apikey. - Discord: Go to Settings -> Devices -> Log Out All Known Devices.
- Google/Email: In Google Account Security, click 'Sign out of all sessions'.
- Steam: Go to Settings -> Manage Steam Guard -> Deauthorize all other devices. Change password and revoke API Keys at
- Using an uncompromised secondary device (e.g., your smartphone via cellular data):
Verification Checklist After Compromise
- Inspect
%APPDATA%\Roaming\AnyDeskor equivalent directories for unauthorized unattended access passwords. - Scan running background startup entries via Task Manager -> Startup Apps.
- Run a comprehensive offline antivirus scan (e.g., Windows Defender Offline Scan).