Daily phishing example #21

Slay___

This phish starts out with a friend invite. After you accept the invite you get asked to play in a TF2 tournament.

Chat log

Website

After clicking "Join the game!", "Sign In", or any other links you might see you will get prompt to log in using Steam.

Log in prompt

Fake Steam login page

The login page does not say steamcommunity.com so it is easy to spot. Never login on websites that do not show steamcommunity.com address.

How to avoid this phish?

Always check that the address starts with https://steamcommunity.com and just to be safe you can type that yourself to avoid look a likes with different symbols that may look like the real letter but aren’t, for example i is not ı and so on.

Another simple trick is to login at https://steamcommunity.com first, then if you are feeling brave enough open possible suspicious link(s) and see if you are logged in or not. If you are automatically logged to Steam then it’s very likely the real Steam openID portal.

The real page will know your display name, username and Steam wallet balance as long as you are logged in already before hand.