Fake Steam authenticator downloads
A counterfeit authenticator does not need to break any cryptography. It only needs access to your readable maFile or an unlocked vault. This page describes what a malicious build can do, how to check a release's origin, and what to do if you think you have already run one.
Evidence and scope. SDA's own repository warns about fake builds that steal accounts. Our team member's account of a theft is personal testimony, not a forensic analysis of a binary. The capabilities below explain the risk of handing secrets to malware; they do not establish what every counterfeit does or how long it waits.
What the malicious build actually does#
A malicious authenticator can generate correct codes while stealing the same secrets it uses to generate them. Working codes are not evidence of safety. A program you run may be able to:
- Copies the maFile out. The whole file, containing the shared secret, the identity secret, a revocation code and possibly session tokens.
- Keeps the passphrase. If your maFiles are encrypted, the program receives the passphrase when you type it and can retain it or the decrypted secrets. Encryption at rest cannot stop this.
- Auto-approves a confirmation it created. With the identity secret and a valid Steam session, software can approve a pending confirmation. An attacker with sufficient account access can initiate the transaction too. The identity secret alone is not a logged-in session.
- Keep access for later. Copied authenticator secrets do not expire with each login code. A quiet period does not establish that a download was safe; there is no reliable delay to wait out.
“My items are trade-locked, so I am safe”#
Check the actual restriction; do not infer safety from the word “locked”. A trade hold, a Market hold, an item-specific cooldown and CS2 Trade Protection are different mechanisms.
Valve documents both trade and Market holds: a trade hold delays delivery after acceptance, while a Market hold delays a sell listing becoming available. Other restrictions can block both features. Check the item's description and the account's trade and Market restrictions. Where selling is allowed, a compromised account can lose value through this route:
- Eligible items are sold on the Community Market. Only items that are marketable and not blocked by applicable restrictions can be sold. The proceeds, after fees, become Steam Wallet funds.
- The wallet balance is spent without permission. Our team member describes purchases of overpriced items that they believe benefited the attacker. This is spending through Market transactions, not a direct withdrawal or transfer of Steam Wallet funds.
- Completed Market transactions are final under Valve's policy. The Community Market FAQ distinguishes completed purchases from unsold listings, which you can still remove. Report unauthorised activity and secure the account promptly.
There is also a time-sensitive recovery route for eligible CS2 trades. Valve's Trade Protection allows reversal within seven days. It reverses all eligible protected trades from that period and applies a 30-day trade and Market restriction to the initiating account. It does not reverse Community Market sales. Secure the account first, then check Trade History for eligibility.
A restriction may buy time, but it does not remove malware or invalidate copied credentials. Use that time to recover control, not to test whether the attacker waits.
Warning signs and their limits#
- The download has no verified connection to the project. Follow release links from an independently established official address. Projects can legitimately use stores and distribution sites; a familiar logo, GitHub page or search position alone does not establish their identity.
- You cannot authenticate the published checksum. A hash checks byte equality. If an attacker controls both file and hash, matching them does not prove origin. A signature or attestation checked against the expected publisher adds evidence; a missing checksum alone does not prove malware.
- The site asks for your maFile, your password, or your API key. A download or support page does not need these secrets. Steam's own sign-in pages are different: check the actual Valve hostname before entering credentials.
- It arrived through an advertisement or a video description. That placement is not a verification of the publisher or download.
- It requests unexplained administrator rights. Generating codes does not require elevation. A legitimate machine-wide installer may need it; an installer format by itself is not evidence of a counterfeit.
- The page pressures you. A limited-time build, an urgent security update, a warning that your accounts are at risk.
What a genuine release looks like#
For ODA's direct releases, these are the checks and current limitations:
- Published on the repository that holds the source, at a tagged version.
-
A
SHA256SUMS.txtfile listing release artifacts. Ideally a signature over that list too — ours carries one, and the verification page shows how to check it. - A build anyone can reproduce from the tag and compare byte for byte against what was published. Ours cannot be, yet — it is on the list because it is an additional assurance we have not achieved. Build provenance records the workflow and source commit; it does not replace independent reproduction or establish that the source and dependencies are safe.
- No updater inside ODA. The optional direct-build update check reports a new version and links to it. Microsoft Store updates are managed by the Store. Neither policy proves that a release is safe.
- Documented storage locations. Our portable build keeps vaults, settings and recovery data beside its executable; its single-file launcher extracts Electron and Chromium runtime files to Windows Temp while it runs and normally removes them on exit. The ordinary installed build uses the normal application-data directory, because that is where its vault lives.
Step-by-step instructions for checking all of that.
If you think you already ran one#
Treat credentials exposed to the suspect program as compromised. Use a different, trusted device for recovery. Importing the same maFile into a genuine application does not invalidate an attacker's copy.
- Stop using the suspect computer and secure your email account. Disconnect the computer from the network. From a trusted device, change any exposed email password and review its sessions and recovery settings. Email access can let an attacker undo Steam recovery.
- Recover control of Steam and change its password. Start at Steam Support if you cannot sign in. Review authorised devices and revoke unfamiliar sessions. Do not approve sign-in requests you did not initiate.
- Replace the compromised authenticator. Use Steam's removal or recovery process, then set up a fresh authenticator, preferably in Valve's mobile app. Removing it invalidates its old authenticator secrets; changing a vault passphrase does not. Removal also brings Steam trade and Market restrictions. This step does not revoke every other kind of stolen credential, so complete the other steps too.
- Review and revoke any Steam Web API key at Steam's API-key page, including one you did not create. A key is a separate credential, not the same as a password or session; its presence is not required for account theft.
- Cancel pending unauthorised activity. Review trade offers, held trades, unsold Market listings and buy orders. Check eligible protected trades immediately. Report the incident through Steam Support and retain transaction IDs and the suspect download address without sharing your maFile.
- Clean or reinstall the affected system before trusting it again. Deleting the authenticator program alone does not establish that malware is gone. Change other credentials exposed on that computer from a trusted device.