Steam One-Click Vulnerability

reserved for something

sounds like BS

there seems to be some cope going on in the comments

As we're talking malware be sure to update your BIOS to latest version to counter LogoFAIL vulnerability.
https://www.tomshardware.com/pc-components/motherboards/logofail-exploit-bypasses-hardware-and-software-security-measures-and-is-nearly-impossible-to-detect-or-remove

Except that's not how it works. If the "malware" is able to execute after subscribing, that would require a Windows, Linux or Mac exploit or a code execution exploit in the associated game, not a Steam exploit. The downloaded content is not executed when you subscribe. Said data is only accessed when the associated game is run and, under normal circumstances, cannot execute code outside of its own thread.

Steam accounts are, usually, compromised through phishing and manipulation. The affected party signs into a third-party site that has been masked to appear as if it is otherwise legit (or a legit third-party site that has itself been compromised), with the user effectively handing the malicious party the username, password, and current 2FA code to the malefactor. Said malefactor compromises the account but, usually, leaves the account alone for months to reduce the chance the victim will secure the account. After the cooldown period, the malefactor drains the account, begins sending malicious links to friends list via web API so as not to be detected, and/or just outright claims the account. This makes it appear like the "hack" happened suddenly and as a result of some other action.

There is no "one-click vulnerability". The vulnerability exists between the keyboard and the chair.

"The user in this case knows not to click links, but accidentally touched the link which opened the link in the browser."

Can you explain this sentence more, they moved their mouse over the link, without clicking it, and the link opened anyway? Or the user went to investigate the link and accidentally clicked it open?

Also, is it possible to add malware to the steam workshop? I've never really used it but that sounds a bit scary.

Im trying to understand what happened and wether this is possible.
Im trying to put the pieces together spread in your comments

First of all, all of this was on mobile? the chat you clicked the link was in steam app?
So the tab opened in a mobile browser? Wich one?
What did the page looked like?
You sure you didnt click sigin in said tab?

Btw i never victim blame and not attempting to. Even when its social engineering the fault obviously is on the bad actor praying on people.
I dont get people who blame victims. Like if you know a common scam good for you, if you dont know a particular one you wouldve fallen prey - no one in the world is obliged to know what you currently know and heck at some point in time you didtn know. Everyone at some point didnt know how to be aware of any scams. Blaming the victim is ilogical even if it couldve been avoided

I never had lost steam items but i do worry about scams and malware precisely to prevent, but i have fallem to a non-steam irl scam before. The best defense we have where authorities, companies and the tech cant cover us is awareness so i see posts like this as more then welcome

But i do want to understand. Im trying to imagine how a site loading on the browser couldve transfared steam guard away and im failing to imagine (im no programmer, but from what i know of how the involved systems work- isnt much but more then nothing).

Do someone know if steam generates/uses any url for confirming transfer or changes to steam guard? Or if that could be done via steamworks some command and such?

Also supercollider are you sure you dont have any malware prior? Have you clicked other links from said friend or others in the past? Maybe that link was only the last step of the scam. idk, just brainstorming

Where is "Who knows?" variant?

OP had no evidence so he just made some shit up and dumped it onto his site like it's news. Fox and CNN both would like to hire you.
????

View attached image.

The whole true/not true thing aside. I'll just step out of that debate because enough people are poking you about that.
I read the article, and so many things are wrong. Grammar, spelling, punctuation, and overall structure of the article (both content and form), it's all over the place. That discredits you even more because it looks unprofessional, and it's kind of hard to read.

Have you had inventory items stolen on Steam?

No : 104(99%) Voted
Yes : 1(1%)  Vote

New game, guess who the 1 vote is.

A little context, for future readers.
Here is the "article" OP is pulling from: https://akagumo.com/serious-steam-vulnerability
The site in question is the personal blog of a nobody twitch streamer who has such monetized video articles as "Should we ban books?", a 9/11 conspiracy bait article, many other clickbait and trafficbait videos, and many "giveaways" to advertise their discord and twitch channels. Said article, for those unwilling to click/read, is a "trust me bro" third-party claim that "a friend" had their account "hacked" after accidentally clicking a link.

Make of it what you will, but this is the same tripe people have been claiming since Steam trading became a thing.

Before you victim blame. Or jump to conclusions, maybe try to understand what happened. Or ignorance is bliss.

But you explained nothing, proved nothing, and what you told is unconfirmed. Then you mocked commenters.
It's good not to click on random links,but there doesn't seem to be much weight to this post.

According to your comment here it's a mobile device and according to your website it's an Apple mobile device. On iPhones apps are sandboxed, meaning an app cannot pull data from another app. Any outside-of-Steam link would be opened in a browser on Steam Chat, either it's outdated or updated. It's not related to Steam Chat app. To add / replace Steam Guard, they need your phone number as 2FA because Steam sends the authentication code to that number, so they cannot do that. What they can do is using the iPhone as already authorized device, so if the story is true what happened here is they hacked into your friend's iPhone and used Steam app's authenticated credentials file stored on iPhone. So at best, it's an iPhone malware. Not a Steam Guard problem.

Your friend logged in using phishing website and don't want to admit that he or she fell to phishing scam. And once they steal username, password and MFA code they generate Steam Web API key and rest is known. All other methods requires malware on PC and phone.
And if any one click vulnerability really exsists at this moment this scenario would be different:
https://www.youtube.com/watch?v=YOb5qGBdP_I

P.S. I click on every suspiocious link I get in Steam chat only to confirm it is phishing and report it. My items are still in my inventory.

As is often the case in Internet discussions, this thread has quickly devolved to name calling and smearing. Let's try and analyze things with a clear head.

The OP claims their friend was hacked by clicking a link, from Steam chat, and opening it in a browser, on a mobile device. For this to happen, there would have to be a certain sequence of events, which could be described as the following:

1. Hackers come up with a totally new exploit, previously thought impossible because of the way HTTP works.
2. These hackers start using this revolutionary attack to get control of Steam accounts.
3. One such hacker uses their state-of-the-art attack tools to take control of one the OP's friend's Steam friend's account.
4. The hacker messages OP's friend.
5. OP's friend clicks on the link and then immediately closes the browser.
6. Hackers install Steam Guard for the OP's friend's account.
7. Hackers wait two days.
8. Hackers transfer Steam items from OP's friend's account and start messaging OP's friend's contact list.

On the other hand, it's possible there was some miscommunication or a simple misunderstanding, which would reduce the sequence of events to the following:

1. Hackers make up a fake website that asks for credentials, using a well-rehearsed approach.
2. The hacker messages OP's friend.
3. OP's friend enters their login information in the fake website
4. Hackers install Steam Guard for the OP's friend's account.
5. Hackers wait two days.
6. Hackers transfer Steam items from OP's friend's account and start messaging OP's friend's contact list.

If such a revolutionary one-click hacking method existed, it's more than likely that it would be used in large-scale attacks. Moreover, it would certainly be used against other targets, such as bank accounts, trading platform accounts, crypto accounts, social media accounts, etc. The fact that no one has ever heard of such an attack, and that no news outlet around the world seems aware of this breakthrough points to the second sequence being more likely.

Two principles should help us come to our conclusion: Occam's razor and the fact that extraordinary claims require extraordinary evidence. Both suggest that OP's friend entered their login information in a fake website and were not using Steam Guard.

Thoughts: Perhaps your friend clicked a phishing link, then "logged in" there and lost their account, but was too embarrassed to admit they fell for a simple phishing scam and gave you a cover-up story about a "one-click vulnerability" instead.

I find it interesting you are unwilling to listen out to people in this thread - sharing information and observations is a healthy and constructive way to explore a topic. It's good to have conviction in your claims, but not if you are not willing to be open to alternative conclusions based on the information given.

this is a wild discussion

but accidentally touched the link which opened the link in the browser.

Sound like it was a boring old trojan my friend.