If you are a PC gamer, then you have heard of Valve L.L.C's billion dollar gaming product known as Steam. It is only natural that steam scammers look to broaden their attack surface by targeting gamers on Discord. Today, we investigate one such phishing campaign.
Embedded Files
Our adventure starts with an innocent looking link. But on further inspection it is revealed that this link is not as it seems.
is.gd is a popular link shortener, and while it has many legitimate uses, it is often used by malicious actors to obfuscate traffic and make things generally more difficult.
Sadly we didn't get to the link in time. This means we will need to perform some OSINT to discover what happened to our link.
A quick search of "steam gift $50" only lists victim complaints on Reddit and Steam community forums. So now what? If we look back at the original spam message we notice that there appears to be a website preview. This link preview is indicative of a meta tag on the original HTML webpage. When you type out a link in your discord chat, Discord's servers will visit the link you type and search for meta HTML tags on the website, and then use those tags to generate an embed message. So, if we search for the specific meta tags we should be able to find the original steam scamming website.
Bingo! A Cloudflare Radar result! We see "styeanmcoonnmumnlty[.]com" as a target domain. Sadly this has also been taken down as of writing, however we can use some more Osint tricks to reveal that there appears to be a network of similar websites.
Ah, of course more Javascript - the language of the devil. I'm starting to see a pattern here. With the exception of the last website, all these scam websites use the same JS Obfuscator. Most of them also appear to originate from the is.gd link shortener too. Loading the only non-obfuscated HTML code into our browser of choice reveals a neat looking (but nonfunctional) steam phishing site.
We again seem to see a pattern across the results from Cloudflare Radar.
So now what? Well, as of writing the campaign has come to a close with all websites non-functional or displaying 404's.
Well the thing is that these steam scams are a game of whack-a-mole, so there is always a new site popping up. Sure enough, I found an active version, and of course it is protected by cloudflare.
The code itself also seems to be heavilly obfuscated. If you want to have a look at it, its on my github.
The key technique used to scam people is the tried and true "Browser in the Browser" method. I've seen this being used in 2020 by Russian threat actors who utilize complex scripts to create an advanced phishing operation.
These new steam scam sites appear to be Russian in nature based on the comments within the HTML source code, the liberal use of calling the fake browser "Gay" (as shown above) and the fact that the steam guard code which originates from the Russian federation.
Anyways, I forgot to take screenshots of the automated account takeover process (with the sign-in originating from the russian federation), but trust me when I say that you will lose your account once you type in the username, password and steam guard code.
In summary, Russian steam phishing sites are one of the most advanced and convincing phishing sites you can encounter, utilizing automated account takeover scripts combined with the effective use of the Browser-In-The-Browser technique.
Google Sites
Report abuse