🏠 » Counter-Strike » Hackers stealing CSGO skins through iOS vulnerability, Steam API

Hackers stealing CSGO skins through iOS vulnerability, Steam API

Most serious skin collectors and players have thier Steam account protected by two-factor authentication, but it turns out that having the securty feature on Steam isn’t enough. The hijacking of two high-profile accounts in the past year show that a user’s inventory isn’t always as secure as they think it to be.

On November 28, professional CSGO player Paytyn “Junior” Johnson woke up to find that almost his entire inventory had been cleaned out. He’d been the victim of one of two possible attacks that allowed hackers to access not only his Steam account, but also bypass Steam Guard, the platform’s two-factor authenticatior located on a user’s phone. But thanks to a simple backup option, Junior may have lost out on a hefty number of skins.

Hackers access pro’s Steam account, steal skins

Hackers are rumored to be able to gain access to Steam accounts using the backup images of iPhones, allowing them to empty an account’s inventories through a pretty serious flaw. The entire purpose 2FA is to have a second chance to regain control of a compromised account, so users are partly to blame as well. Here’s how it works.

I wake up getting spammed notifications my steams been hacked, I was able to logon and deauthorize the account and changed every password I have, in a span of 5 minutes of me changing everything somehow all of my skins (around 20k) got sent through to another account without 1/2

— Paytyn (@1juniorcs) November 27, 2020

Many players use Apple’s iCloud storage to store photos and contacts, but they can also decide to back up both apps and their settings to the cloud as well. If a player chooses to backup the Steam App, they’re also saving both their log-in credentials, incuding the username and password, as well as Steam Guard itself.

If the player includes applications in their backups, then it’s a fairly trivial process for a hacker that has access to the iCloud account to download this backup. Once there, several utilities exist where users can generate two-factor codes on the desktop instead of from mobile, a move that completely defeats the purpose of 2FA. What happens then is fairly simple, as the hacker uses those three pieces of information to empty the account, either to third-party websites or to a middleman account. Junior eventually recovered his account, but said he hasn’t received any of his lost skins as of yet.

Why do you need Steam Guard and other two-factor authentication?

As of 2016, Valve announced that with 2FA in place and the proliferation of third-party sites, they would no longer regenerate skins for players who had them stolen. Valve’s concern was that not only could a user pretend to be robbed, eventually getting the “stolen” skins back from a second account or the money from its sale, but that third-party skin sites were making a killing while the developer watched money move outside the Steam ecosystem. Since Valve takes a 15% cut of every CSGO item sold on the Steam Marketplace, so Valve obviously prefers to keep everything in-house.

How do Steam accounts get stolen?

There are three main ways. The first would be if a user’s email address and password were stolen. With those pieces of information, a hacker could reset the email connected to the account. Steam recommends that players never “use the same password for both their email and their Steam Account.”

The second way is through the process mentioned above, where the hacker has access to both the Steam Guard backup and the user’s email and password. The third way is through malware. Keyloggers and viruses are some of the main ways hackers can access the data needed to clean out an account.

Will Valve return stolen skins to thier owners like Stewie2k?

There’s still hope for Junior’s skins. Team Liquid’s Jake “Stewie2k” Yip had his own account hacked in a similar way during the 2019 StarLadder Berlin Major. Luckily, Valve restored access to the pro’s account and returned to him his skins, so it’s possible that Junior will be just as lucky. Even CSGO observer DJ “Prius” Kuntz revealed that he was a victim of a similar attempt during a stint at IEM Katowice.

Much love & appreciation for the quick recovery @CSGO . Stole thousands of dollars of skins without trade ban & i have no idea how. Hats off for the hacker, dedicated your life for these things…got what you want. Seems like @CSGO got it all under control though ❤️

— Jake (@Stewie) September 5, 2019

There are an entire host of scams used on Steam to trick people out of thier items, so it’s best to follow the simple rules of the internet to keep things safe.

  • If it’s too good to be true, it probably is.
  • Never share your password with anyone. 
  • Enable 2FA on all ways into your account like an email address, phone, and Steam itself.

Finally, enabling Steam Family Sharing is an odd way to work around the issue, but it requires players to enter another four digit pin in order to do anything through the Steam Service. Prius reccomendeds it as a way to further lock down an account, but it need to be enabled correctly to function. Users can find out more about Family Sharing and how it can protect them through Steam’s FAQ.

Read Also
Unlocking the Wavebreaker Pack in Fortnite: A simple guide
The Wavebreaker Pack has made an exciting return to Fortnite after a ...
World of Warcraft leak: events and cosmetics for Patch 11.0.7
Fans of World of Warcraft are buzzing with anticipation as leaks from ...
Where to find Eminem and Mom’s Spaghetti in Fortnite
Fortnite players are gearing up for an exciting crossover event as Eminem, ...
Step up your style in Fortnite with new Kicks cosmetics
Fortnite is stepping up its game with the announcement of a brand-new ...
Valorant Arcane 2.0 bundle – What we know so far
With Riot Games officially teasing the Arcane 2.0 bundle, Valorant fans are ...
Latest News
DanLudan continues win streak on popular online slot
DanLudan continues to prove to his streaming audience ...
G2 Esports vs M80: PGL Astana CS2 betting guide
With two rounds of the PGL Astana group ...
Team Spirit vs Ninjas in Pyjamas: PGL Astana betting guide
Ninjas in Pyjamas took a shocking victory over ...
The MongolZ vs Furia: PGL Astana CS2 betting guide
PGL Astana is the next big stop in ...
Roshtein finds major jackpot while streaming slots on Kick
The self-proclaimed "slot streaming OG" hit a massive ...
Virtus.pro vs Ninjas in Pyjamas: PGL Astana full CS2 betting guide
PGL Astana is bringing in some fresh faces ...
BankrollBros score big playing Blitz Super Wheel
It’s not every day that a streamer turns ...
Lord Treputin turns it around with Big Bass Bonanza payout
Lord Treputin is no stranger to big wins, ...
All of the best slot bonuses and offers for May 2025
Slot bonuses are a great way to stretch ...
Check out the best and most fun cartoon-themed slots you can play
Playing online slots can be stressful when you're ...
Editor's Picks
Who is Stevewilldoit? Net worth, girlfriend, and more
The news of Stephen "Stevewilldoit" Deleonardis, the master ...
All we know about Thea Booysen, MrBeast’s girlfriend
Jimmy "MrBeast" Donaldson is known purely for his ...
How to quickly make infinite water in Terraria
Whether you’re looking to spruce up your Hellevator ...
Best Pokemon Glazed cheat codes
Pokemon Glazed is one of the most popular ...
How to enable net graph in CS2 
Competitive players were disappointed when they discovered that ...

Players must be 21 years of age or older or reach the minimum age for gambling in their respective state and located in jurisdictions where online gambling is legal. Please play responsibly. Bet with your head, not over it. If you or someone you know has a gambling problem, and wants help, call or visit: (a) the Council on Compulsive Gambling of New Jersey at 1-800-Gambler or www.800gambler.org; or (b) Gamblers Anonymous at 855-2-CALL-GA or www.gamblersanonymous.org.

This site is using Cloudflare and adheres to the Google Safe Browsing Program. We adapted Google's Privacy Guidelines to keep your data safe at all times.
21+NCPGGamblers Anonymous
×
Your Promo Code:
The bonus offer of was already opened in an additional window. If not, you can open it also by clicking the following link:
Visit Site