Fake Steam authenticator downloads
A counterfeit authenticator does not need to break any cryptography. It only needs you to open your maFile with it once. This page describes what those builds actually do, the signs that separate a real release from a trap, and what to do if you think you have already run one.
What the malicious build actually does
It works. That is the part people find hardest to believe. A stealer that failed to generate codes would be deleted within a minute, so it generates codes correctly and looks like the real thing. In the background it does one or more of:
- Copies the maFile out. The whole file, containing the shared secret, the identity secret and the revocation code, uploaded on first run.
- Keeps the passphrase. If your maFiles are encrypted, the program has to see your passphrase to decrypt them. So it records it.
- Auto-approves a confirmation it created. With the identity secret, an attacker can raise a trade and confirm it from their own copy. Nothing appears on your screen.
- Waits. Often weeks. Theft timed to the moment you enabled it would point straight at the download.
“My items are trade-locked, so I am safe”
This is the assumption that costs people the most, and it is wrong. A trade hold stops items being traded away. It does not stop them being sold.
When an attacker finds half an inventory under a trade hold, they do not wait it out. They use the Community Market instead, and the sequence is always the same:
- Everything is listed on the Community Market and sold. Market sales are not blocked by the trade holds that were protecting those items, and the proceeds land in the account's Steam Wallet.
- The wallet balance is spent on the attacker's own listings. They have already listed near-worthless items at enormous prices. Your balance buys them. The money moves to an account they control, and what you are left holding is a handful of items genuinely worth a few cents.
- Nothing can be reversed. Steam Wallet funds cannot be withdrawn to a bank, and market purchases are not refundable. By the time the emails arrive, the value has already left.
It is worth being precise about what this means: the trade hold never failed. It did exactly what it was designed to do, and the attacker simply used a route it was never meant to cover. Anyone reassuring themselves that a locked inventory makes a compromised authenticator survivable is protecting against the wrong thing.
It also explains the timing. These thefts tend to arrive a couple of weeks after the download rather than the same evening — long enough that nobody connects the two, and long enough for a trade hold to look like it held.
The signs, in order of how much they tell you
- The download is not on the project's own source repository. This is the one that matters most. Real projects release from the same place the code lives. A download hosted on a marketing page, a file locker, a shortened link, or a Discord attachment has no chain back to any source.
- There are no checksums, or the checksums are not published separately from the file. A hash printed next to the download by the same person who could swap the download proves nothing.
- The site asks for your maFile, your password, or your API key. No authenticator needs to be given anything through a web page. Ever.
- It arrived through an advertisement or a video description. Paid placement above the real result is a standard part of this.
- It wants to be installed rather than unpacked, and asks for administrator rights. An authenticator does not need administrator rights.
- The page pressures you. A limited-time build, an urgent security update, a warning that your accounts are at risk.
What a genuine release looks like
Ours, when it exists, will look like this — and so does any other project worth trusting:
- Published on the repository that holds the source, at a tagged version.
- A
SHA256SUMSfile listing every artifact, and a signature over it. - A build that anyone can reproduce from the tag and compare byte for byte against what was published.
- No installer that reaches outside its own directory, and no self-update.
Step-by-step instructions for checking all of that.
If you think you already ran one
Assume the secret is copied. Speed matters more than certainty here — the steps below cost you an afternoon if you are wrong, and save the account if you are right.
- Detach the authenticator from Steam using the revocation code. This invalidates the shared and identity secrets. A copy of your maFile becomes worthless. This is the step that actually stops the theft.
- Change your Steam password, from a machine you trust.
- Deauthorise all other devices in Steam's settings, which kills any session the attacker is holding.
- Revoke your Steam Web API key if you have ever created one. An API key left behind is a common way access survives a password change.
- Re-enable Steam Guard fresh, and treat the machine you ran the build on as compromised until you have dealt with it.