With the development of digital technologies, new technologies for distributing malware, Trojans, stealers, and other tools used for fraudulent activities are also evolving.

Account Theft Through a Phishing Attack

In July 2026, security researchers discovered a new vulnerability in the Steam platform that makes it possible to steal data with a single click and spread through a user’s friends.

This type of attack is called “phishing” and is carried out through a malicious link that you may receive on Discord or from other Steam users whose accounts have been compromised. On the surface, the link looks like an ordinary Steam game or store page. After the user follows it, the system redirects them to the Steam home page. It appears that everything is operating normally and that Steam has simply opened; however, at that very moment, the account data has already been transmitted to the attacker. The malicious code then begins spreading through Steam on its own, infecting accounts from the victim’s friends list.

In this regard, a separate section on phishing was added to the “Account Security Recommendations” section of the official Steam Support page, containing the following recommendations:

• NEVER give out your password to anyone.
• NEVER click unknown links from untrusted sources, and check links sent by your friends. Their account may be compromised!
• NEVER follow instructions to speak with someone claiming to represent Steam Support through Discord or any other chat system, including Steam Chat, even if they come from a friend's account or claim to be able to resolve a false report.
• ALWAYS make sure you log out when finished at a cafe! Deauthorize untrusted devices immediately if you forgot to log out.

On July 23, 2026, it was reported that Russians were being deprived of their Steam accounts en masse under the guise of gifts on Twitch:

“According to the expert, attackers distribute links to allegedly free promo codes, rare in-game items, and rewards for watching streams. The links are distributed through private messages on Twitch, comments, Discord, and Telegram communities. On phishing pages, users are prompted to sign in through their Steam, Epic Games, Xbox Live, or PlayStation Network accounts.”

Account Theft Through Malware

This type of account attack is also common among Steam users. Steam’s official recommendations state:

• Malware that targets Steam may be disguised as Pirated software, cheats, fake game demos / betas, or gaming adjacent utilities such as communications software, mod / inventory managers, etc.
• Modern malware packages may be bespoke enough to avoid detection from common antivirus software, wait for the targeted software to be in a state that's worth triggering an attack (such as an account having funds available in its Steam Wallet), and some packages may remove themselves from a system after performing their intended goal.
• Always be skeptical of software linked to you by others even if it is hosted on a platform that you'd normally trust, research any application or offer that requires the installation of software, and ensure you are downloading software from the official source.

Applications that steal your account data are called “stealers.” A recent report by Kaspersky Lab security experts shows that stealers are very actively disguising themselves as tools for bypassing restrictions.

Given the relevance of restrictions in Russia, this method of stealing personal data is becoming especially widespread. An article on Kaspersky’s website explains in detail how this happens and what stealers target.

Please note that stealers can steal more than just your Steam account data. Depending on the application, a stealer may steal configuration files, settings information, and account data from the following applications:

• VPN clients;
• messengers: Telegram, Discord, Signal, Element, Viber, Tox, Jabber, and others;
• game clients and services: Steam, Epic Games, Riot Client, Battle.net, Ubisoft Connect, Roblox, and various Minecraft clients;
• cryptocurrency wallets: Ethereum, Electrum, Atomic, Guarda, Coinomi, Zcash, Armory, Bytecoin, Jaxx, Exodus;
• network clients and utilities: ngrok, Playit, Cyberduck, FileZilla, DynDNS;
• the Outlook email client.

It should also be emphasized that some search engines place “alternative” versions containing stealers, rather than what you were looking for, at the top of search results.

Thus, by downloading applications from unofficial sources, you expose yourself to risks.

Steam Wallet Funding and Funpay Services

Another way to steal your account data is through services that provide Steam Wallet funding, which is also relevant in Russia. There are many websites on the Internet that provide Steam Wallet funding services.

As a rule, such websites require you to provide access to your Steam account, which immediately puts the security of your account at risk.

Thus, the safest ways to fund a Steam Wallet are applications from Russian banks or the websites of such large and well-known companies as VK and the VKPLAY platform.

Services and third-party software from Funpay, including services for selling and leveling up characters, also pose a risk of losing characters, including due to violations of the License Agreement.

Under clauses 4.7.4 and 4.7.5 of the game’s License Agreement, ensuring the security of an account on the Steam/VKPlay platforms is the User’s direct responsibility:

4.7.4. User authorization in the Game is accomplished through player authorization on the gaming Platform. The User is responsible for independently protecting access to the Game Platform account in accordance with the rules and recommendations of the Platforms, which are accessible at the following addresses:

Steam: https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60
VKPLAY: https://support.vkplay.ru/vkp/login/4849

4.7.5. The User undertakes not to disclose or transfer to third parties their data that may be used for authorization (authentication) in the Game. The User is responsible for taking measures to ensure secure access to their Game Platform account and prevent its unauthorized use by third parties.

Thus, it is the User who is responsible for the security of their Account on gaming Platforms.

We do not control the process by which the User accesses the platform—the Steam gaming platform itself does so (through authorization in “Steam”); we deal only with an anonymized account on the gaming Platform.

If the gaming platform informs us that you have logged in, we naturally trust that information (we simply cannot do otherwise, because we do not have that capability).

It follows that we cannot determine in any way which particular person logged in to the platform, since the account data is anonymized for us in accordance with the Privacy Policy.

Likewise, we cannot determine who entered the game using your account: it could have been you, a friend whom you allowed to play, or an attacker.

Naturally, on the basis of all the above, we regard all actions within the game as legitimate (including trading, transferring in-game items, in-game currency, etc.).

Most importantly, we cannot be held responsible for actions performed by third parties using your account on the Steam platform simply because this is NOT our area of responsibility.

Under the License Agreement, we are not liable for:

6.4.1. any losses that may arise in connection with the use or inability to use the Game by the User, even if the Company has been notified of the possible occurrence of such losses;

6.4.2. the performance of the Game on the User’s computer;

6.4.3. performance indicators of the Game on the User’s computer in the event that the User’s computer does not meet the minimum system requirements (see Section 8 of the Agreement);

6.4.4. illegal and other actions of the User or third parties that prevent other users from using the Game;

6.4.5. behavior and statements of users in the Game, including disrespectful attitude towards other users;

6.4.6. The Company is in no way responsible for the User’s access to the gaming Platform account:

6.4.7. loss of access by the User to the Account on the gaming Platform used.

Steam account theft can be prevented by following Steam’s security guide, available at: https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60. This is in fact sufficient to avoid having your Steam account stolen.

To summarize, you should:

• Enable multi-factor authentication;
• Enable Steam Guard;
• Exercise caution when following links, even if they were sent by people you know (their accounts may also have been compromised);
• Be careful when installing third-party programs;
• Use protection tools (Steam Guard, antivirus software);
• Remember that no safe program requires you to disable your antivirus software.

The recommendations are simple and require attentiveness. Remember that theft of a Steam/VKPLAY account is the result of careless actions by the User.

Sincerely,
the WTL team.