Open Desktop Authenticator

Fake Steam authenticator downloads

If you ran a suspicious authenticator or gave it your maFiles, start recovery from a different, trusted device. Working Steam Guard codes do not establish that a download is safe. If you have not run it, check its origin before opening it.

If you already ran a suspicious authenticator

Treat credentials exposed to the suspect program as compromised. Use a different, trusted device for recovery. Importing the same maFile into a genuine application does not invalidate an attacker's copy.

  1. Stop using the suspect computer and secure your email account. Disconnect the computer from the network. From a trusted device, change any exposed email password and review its sessions and recovery settings. Email access can let an attacker undo Steam recovery.
  2. Recover control of Steam and change its password. Start at Steam's account-recovery instructions if you cannot sign in. Review authorised devices and revoke unfamiliar sessions. Do not approve sign-in requests you did not initiate.
  3. Replace the compromised authenticator. Use Steam's authenticator-removal instructions, then set up a fresh authenticator, preferably in Valve's mobile app. Removing it invalidates its old authenticator secrets; changing a vault passphrase does not. Removal also brings Steam trade and Market restrictions. This step does not revoke every other kind of stolen credential, so complete the other steps too.
  4. Review and revoke any Steam Web API key at Steam's API-key page, including one you did not create. A key is a separate credential, not the same as a password or session; its presence is not required for account theft.
  5. Cancel pending unauthorised activity. Review trade offers, held trades, unsold Market listings and buy orders. Check eligible protected trades immediately. Report the incident through Steam Support and retain transaction IDs and the suspect download address without sharing your maFile.
  6. Clean or reinstall the affected system before trusting it again. Deleting the authenticator program alone does not establish that malware is gone. Change other credentials exposed on that computer from a trusted device.

SDA's own repository warns about fake builds that steal accounts. The explanation below describes what exposed credentials can enable. It does not identify what a particular download did; that requires examining the file and the affected account.

What the malicious build actually does#

A malicious authenticator can generate correct codes while stealing the same secrets it uses to generate them. Working codes are not evidence of safety. A program you run may be able to:

“My items are trade-locked, so I am safe”#

Check the actual restriction; do not infer safety from the word “locked”. A trade hold, a Market hold, an item-specific cooldown and CS2 Trade Protection are different mechanisms.

Valve documents both trade and Market holds: a trade hold delays delivery after acceptance, while a Market hold delays a sell listing becoming available. Other restrictions can block both features. Check the item's description and the account's trade and Market restrictions. Where selling is allowed, a compromised account can lose value through this route:

  1. Eligible items are sold on the Community Market. Only items that are marketable and not blocked by applicable restrictions can be sold. The proceeds, after fees, become Steam Wallet funds.
  2. The wallet balance is spent without permission. Our team member describes purchases of overpriced items that they believe benefited the attacker. This is spending through Market transactions, not a direct withdrawal or transfer of Steam Wallet funds.
  3. Completed Market transactions are final under Valve's policy. The Community Market FAQ distinguishes completed purchases from unsold listings, which you can still remove. Report unauthorised activity and secure the account promptly.

There is also a time-sensitive recovery route for eligible CS2 trades. Valve's Trade Protection allows reversal within seven days. It reverses all eligible protected trades from that period and applies a 30-day trade and Market restriction to the initiating account. It does not reverse Community Market sales. Secure the account first, then check Trade History for eligibility.

A restriction may buy time, but it does not remove malware or invalidate copied credentials. Use that time to recover control, not to test whether the attacker waits.

Before downloading: check the source

  1. The download has no verified connection to the project. Follow release links from an independently established official address. Projects can legitimately use stores and distribution sites; a familiar logo, GitHub page or search position alone does not establish their identity.
  2. You cannot authenticate the published checksum. A hash checks byte equality. If an attacker controls both file and hash, matching them does not prove origin. A signature or attestation checked against the expected publisher adds evidence; a missing checksum alone does not prove malware.
  3. The site asks for your maFile, your password, or your API key. A download or support page does not need these secrets. Steam's own sign-in pages are different: check the actual Valve hostname before entering credentials.
  4. It arrived through an advertisement or a video description. That placement is not a verification of the publisher or download.
  5. It requests unexplained administrator rights. Generating codes does not require elevation. A legitimate machine-wide installer may need it; an installer format by itself is not evidence of a counterfeit.
  6. The page pressures you. A limited-time build, an urgent security update, a warning that your accounts are at risk.

What a genuine release looks like#

For ODA's direct releases, these are the checks and current limitations:

Step-by-step instructions for checking all of that.

Published and reviewed by MASTERPANEL LLC. Last checked . Editorial method.