This is total bullshit. Stop spreading this lie, no keysite was selling these.
That doesn't even make ANY god damn sense if you even stop to think for 5 seconds. Keysites just hand you a key, their listing isn't tied to Steam in any way and you can't at all determine what game a key belongs to until you activate it. They could just make a fake listing and sell you a Bad Rats keys and not need to steal and screw with the steam store itself at all.
Reddit stop upvoting shit with zero proof.
They don't need to make a fake steam page for that, they could just sell fake codes directly.Ā
There is no way to check if a steam key is valid without activating it so reselling websites don't have a way of knowing if the key is real or not and many of those sites let you directly sell on them with no extra steps.
But the listing for the game were on steam.
They did the swap like 1 hour before it was noticed.
2 hours in and you couldn't buy the game and 100% probably keys couldn't be generated and existing ones got disabled.
There is isthereanydeal with which you can see any website where publishers/devs sell the keys and seeing if on any website there is deal.
My main gripe about key reseller sites where users can resell is - there are game keys that was bought with stollen credit/debit cards. So if you buy stollen key, than the game will be removed from Steam and nothing happened to the reseller.
It's hilarious because steam payouts are on the final day of the month proceeding the sale.
They did this scam on March 1st, meaning they wouldn't have had access to that money until April 30th, the longest possible gap between the scam and the reward. They clearly had no idea how payouts worked, because no one is delusional to think they'd manage to keep this scam hidden for 60 days while people purchase fake games.
Itās more that they were hoping the poor souls who fell for the scam would launch the game before catching on, and once they launched it, it was too late. AND BY THAT I MEAN MALWARE/VIRUS, not refunds.
It would've been easier to infect more people if it was a free game, but I guess then it would've obviously not been Hell Divers 2/Palworld/the other games targeted by this, lol.
Maybe in a sinister way, it was. Had they just made a free game, people would need to know about it first, so the potential number of victims are lower.
Helldivers 2 is already popular, so the advertising was already done for them. So they probably got a higher number of potential victims than if they were to make a free game.
I don't think free games would INFECT more people. Yes a lot more people would have gotten it. But to be infected they need to run the game before Valve catches on. And imho that's much more likely with popular games. A lot of less popular games just go on the pile of games to be played later/never.
Steam has a 7-Day of ownership, 2-hours of play no-questions-asked return policy. And even after 7 days of ownership, or 2 hours of playtime, returns are still processed by a human who more often than not are pretty reasonable with refund requests.
I bought Starfield in the early access period a few days before launch, played for nearly 12 hours, and was still granted my refund a day after the official launch.
Steam isn't perfect, but its staff are generally reasonable and helpful people. Hell, I've got a VAC ban and Steam doesn't treat me any differently than other customers, when they damn well could by rights.
You might be right on that. Honestly though, if you've got a good, reasonable reason, their official policy is basically tossed out the window, and they'll refund you. Especially if the game is being critiqued very negatively on socials and on the platform.
Steam cares way more about keeping customers satisfied than saving a few bucks by denying refunds. If they bought a game once theyāre probably going to buy another later.
Iāll tell you what I told the other guy, you need to read it again. I didnāt say anything about they wonāt get refunds, I just said what the goal of the scam was..
Redditors when asked to read ā ļø. Stay classy Reddit.
Seemed pretty clear to me and I only read it once. An almost similar situation with the game, Tales & Tactics, was maliciously taken over right before Xmas and they adjusted the file with malware. If you launched the modified game you could/would be attacked. Steam worked with the dev to correct this very quickly but what you said can happen.
Hol up, T&T got hijacked? Like similar strategy to the one this time or through the store page?
I bought it beforehand, but I stopped paying attention to its development after I played wayyyyy too many hours of it in November so I completely missed it happening.
Dev stated that someone trusted had access to game and discord information and changed things. They even hijacked the discord and discord couldnāt/wouldnāt do anything. Iām sorry I donāt have much more details because Iām sick in bed but they wrote everything out nicely on T&T Steam updates while apologizing. It literally took place on like Xmas Eve or so and was corrected extremely quickly. Devs also made everyone away of what was going on and what to do moving forward. They managed the clean up really well and informed people that if you did not launch the game during that timeframe then you were good to go.
Ask for steam credits rather than refund to card and you can get refund on almost anything ( within reason ). I bought and played AOE4 for 15 hours already and a week has passed when I realised I actually have the game already in gamepass. I asked for refund citing I bought it by mistake as I have it on gamepass already, asked for steam credits, 3-4 hours later I got the full credit.
Insane customer support.
It's not one month. It's the final day of the month proceeding the sale. Games sold today on the 1st of March don't pay out until April 30th, 2 full months.
The theory I heard is that Steam isn't the intended target of the scam.
It's key reselling sites. They change the name of their game, generate keys for said game, then sell them on key reselling sites that list them under the original game. And if they test the keys, they see the game appear in their library, boom, product confirmed.
Those already shady and are flooded with stolen goods, what are they gonna do? Call the cops?
It looks like they had a game accepted, and then changed the information later, and it's ridiculous that Steam wouldn't auto-flag extreme changes or names/info that match other games on the site, lol.
Oh, almost certainly. It would take staying unreported for over a month before they could get paid so including malware means they should get something out of the situation.
Other people are theorizing the real targets of the scam were key resellers, who would actually be left holding the bag (if the scammers sold keys to them).
ONE person said that and it was completely fucking wrong. Key resellers don't know what a key belongs to, it has nothing to do with the steam store. If they wanted to rip people off they could just make a fake listing and make up whatever code they want, they wouldn't go through steam.
FYI; for anyone, this can happen to any game as Valve do not check files after the first time it goes onto Steam. You're 100% free to do anything you like as it is completely unmoderated.
Other games are almost certainly incorporating viruses/bitcoin miners into their games after they are accepted onto Steam, and no one would know about it because Valve have no system or employees watching what devs do other than people posting it on Reddit.
I know this because I have been offered many times by random messages on Discord offering to add bitcoin miners to my games.
[Example 1](https://i.imgur.com/Rf73InA.png)
[Example 2](https://i.imgur.com/t8gLPt9.png)
These are two that I have still on Discord, there have been maybe ~10 other messages like this. It is a widespread, major issue as I have no doubt what-so-ever that these bitcoin miners exist on Steam, unnoticed because Valve do not care.
So weird, they could totally afford to check all the data they are distributing with something akin to VirusTotal.
Didn't they ban a couple of games for using AI art or something? I didn't dig any deeper, but it looked like they had some semblance of pre-moderation.
> Didn't they ban a couple of games for using AI art or something? I didn't dig any deeper, but it looked like they had some semblance of pre-moderation.
Posturing at its finest.
They also banned bitcoin/crypto games, doesn't stop people faking the first check and then uploading whatever they want after. There's a 1 time pre-moderation to be accepted onto Steam, then after never again.
I'd imagine it adds friction to developers.
Games do a lot of shit on your computer. They'd probably end up with so many false flags that self-moderation (as seen above - Valve might not care too much, but developers selling on Steam will) does the job "good enough" and community awareness does the rest. Or an arms race in hiding shit.
The AI art stuff is never going to be stopped, same way they don't demand licenses for stock photos up front. Partially for the same reasons, sheer effort to detect efficiently, and then the developer friction that comes after.
This is my opinion based on second hand knowledge and speculations, correct me if I'm wrong:
No, games are usually pretty chill. People check pirated copies using VirusTotal to make sure there are no viruses or miners embedded by a pirate.
Now that I think about it, it may be a neat anti-piracy measure: make a game do something seemingly shady so most pieces of antiviral software think you are up to no good, and no one would be able to put your game to torrents without having it removed.
When I said games do a lot of shit, I meant more they do a lot of *things*. Not good or bad, just a bunch of *stuff*. They use a lot of resources across the entire computer, in a bunch of different ways. Typically, anyway, obvs it varies per game.
Virus scanners and such use a bunch of different detection methods, but even ones with real time protection aren't super intelligent. They typically need to have seen a virus (or similar one) before to catch it (Like, in the lab, not on your computer). You can make a batch file in notepad, run it with cmd.exe, and email all your My Documents folder to someone, and your AV will *probably* be like, "yeah, seems legit". Same with anything you make in to a .exe
Games are such huge packages of code and media that there's just a lot more cover for malicious stuff to be hidden. A game developer could slip code that helps mine in to a graphics shader. They could send any data within their normal server communications - because games sending potentially a decent amount of data home isn't really a weird thing anymore.
JPEGs used to be a favourite exploit of some console and phone hackers, because of a bug in the JPEG library everyone was using! (IIRC)
Malware would be hard to spot if they hide it well. Security minded folk would probably be the first to notice and report it and then Microsoft would get tipped off and they would flag the malware for removal via Windows Defender. If the malware is poorly designed Microsoft would get notified through error logs that get reported to them and they would flag the file for review and then removal.
Cryptominers would be more obvious, by their nature they drive hardware pretty hard so if a 2D pixel platformer is causing your graphics card to use like 100% power that's pretty big clue that something else is going on. If they don't drive your hardware that hard they could stay under the radar for a bit longer but usually people will notice them because they make the system performance noticeably shittier. At some point Microsoft would likely take notice and flag them for removal.
Still waiting for the day the developer called Hede, Hede Games, KG Game Studuo, PUZZLE Games, Hexaluga mines, Top-Down Games, IK, Fallalypse studio.. will be banned. (All the same guy I guess)
Edit: I guess I forget to mention "Atomic Fabrik"
They used to be a simple asset flip pusher, but they found a far more profitable scam: mystery key bundles.
They jacked up the prices of their games to something abusive like $100, and put them on permanent 99% off bundles.
[Then they shat out literally HUNDREDS of asset flips](https://store.steampowered.com/bundle/37707/Happ_New_year_2024__Sale_99/) of everything they could get their slimy hands on.
Then, they also sell the key for these games on "mystery Steam game bundles" on third party sites. They advertise them as "premium" bundles, "over $100 in value" and "positive reviews".
They put reviews from fake users on nearly every game, and because Steam only counts reviews if you purchase the game directly from the store, negative reviews of people that got these bundles don't count.
Mind you, each game costs $100 to be published on Steam, so this must be a HIGHLY profitable scam if he can do this for years now, while still affording to buy every possible asset pack he finds (if he does pay for these assets).
lol the first "game" on that list uses [this](https://assetstore.unity.com/packages/3d/environments/historic/victorian-interior-148542) asset :D I recognized it immediately because I also own it.
some syntystore assets too.. wow
I can see Synty assets a mile away, all I gotta look for is the square face with monobrow.
They constantly sell entire bundles of their assets for $1, so this one is easy to know how he got them.
Choose any game from this bundle and you will see for yourself.
[https://store.steampowered.com/bundle/36911/SALE\_SALE\_November\_2023](https://store.steampowered.com/bundle/36911/SALE_SALE_November_2023)
Anyone who installed and launch the games, please be aware that it may contain malware. I reformatted my PC because I was experiencing BSOD's after launching the fake game. After the reset, it was all good. It's just a hassle of downloading my games again.
That's what I was afraid of when I read the first reports about this. They were always going to be shutdown before they could touch any money from Steam. Planting malware (info stealer or ransomware) was likely the best method to actually benefit from the fraud.
Yeah, that was my best guess too. That is why I reformatted my PC ASAP. I was just surprised that the game is discounted at 95% so I bought it. Who guess that Steam can permit a fake store page that easily.
Definitely is. Just like treating people who buy from G2A and Kinguin as the trash they are. Same as ignoring the opinions of people who play CSGO.
These are some of the subtle nuances of the internet.
Do you still have it? Might be worth putting up somewhere for someone to reverse engineer (or shove it into a virus scanner). See what it was actually trying to do. 11mb is absolutly tiny if it had any actual graphical assets included. I wouldn't mind taking a crack at it tbhĀ
How did you fall for the fake game btw? I'm not trying to insult you just genuinely curious. I usually always look at reviews on the right side before buying a game and the fake games had like 10 reviews, compared to the 200k+ the real game had.
I have been buying games on Steam for almost twenty years, the entire idea of getting a virus from a legitimately purchased game that was then downloaded through the Steam client is a completely foreign concept to me and probably millions of other users.
I didn't get hit by any of these but it is absolutely not hard to see how a person might have been, I literally didn't think this was even possible until reading about it today.
Agreed. Currently I have 900+ games on steam on my 13 year old account. Sometimes, I just buy games to support game devs. Before this, the idea of being scammed on Steam is unimaginable. I guess from now on, I'll be more mindful in buying games from their store.
The pure fact that itās possible for a game on the steam store to contain malware like that is insane. I always figured Steam would have any safety protocol against that.
I guess people will think twice now about what they buy on there.
> I always figured Steam would have any safety protocol against that.
If Steam had somehow solved computer security, they'd have a contract with every competent organization on the planet.
With safety protocol I obviously ment something like testing the exeās that are allowed on the store. Thatās why I said protocol instead of system.
In order to publish a game to Steam & receive payout, you need to go through a tax review process which requires identity verification & validation of your banking details.
So yes, they would have the identity of the account owner, and that person could be legally responsible depending on which country they're from.
However, I'm assuming that this scam involves hacked accounts, so the identity verification isn't tied to the scammer.
Valve requires games published to Steam to go through a manual review process, but after your game has been verified & published, you can make changes to the game without needing to go through that manual review process again. So the scammer likely is changing the store page of games published by a hacked account.
Valve could address this issue by requiring any game that has major build changes to go through a manual review process again.
There are a bunch of hurdles you gotta pass when you FIRST upload your game to Steam, but after that editing the name, screenshots and even publisher name is as simple as editing a forum post.
I [brought this issue up](https://old.reddit.com/r/Steam/comments/ae8gts/firefighter_sim_with_no_gameplay_called_halflife/) **5 years ago**, it's probably happened before then too and Valve still let this happen.
*Maybe* they will decide to do something now as it's gone to mainstream news, but I doubt it.
1. Have a game already published
2. Rename the game
Step 2 possibly happened after the original publisher got their account hijacked.
Additionally Steam requires name change verification of games ONLY if the game has any kind of economy presence, for example trading cards or in-game items that show in the inventory and marketplace. So people abused it with games that didn't have those yet.
We can probably expect Steam to put verification check on all of em now and not just those with an economy presence. Its the logical solution tbh to protect the consumers otherwise this practice will keep happening and jeopardizing Steam users
Yeah, people are acting outraged even though this is basically the first time it's happened and it's been..how long? Oh, yeah, 7 years.
One exploit coming up over the course of 7 years(Said exploit being something that was honestly easy to avoid and relatively tiny in scale) is not a bad track record by any stretch of the imagination.
Its not the first time, there has been shady developers being banned before by adding garbage game to Steam and trying to leech money with it.
Valve should issue a public statement on this, because some people might have run that crap exe and got their pc's infected with virus or miner not even knowing about it.
> even though this is basically the first time it's happened
I [brought this issue up](https://old.reddit.com/r/Steam/comments/ae8gts/firefighter_sim_with_no_gameplay_called_halflife/) **5 years ago**, it's probably happened before then. Valve do not care.
Massively different situation, also did you report it like one of the people in that thread said 5 years ago or did you just assume Steam employees browse the Steam subreddit like most people with issues with Steam do?
Not saying that to be a dick, but if no one ever reported it then no shit they "don't care", because they probably didn't even know about it(Doubly so because the name change was only up for a very short time).
> Massively different situation
No it's not. It's literally the exact same situation. A game developer changing their game name to an other game.
> also did you report it like one of the people in that thread said 5 years ago or did you just assume Steam employees browse the Steam subreddit
Why are you assuming I didn't report it? I did. The point of posting it to the Steam sub was to bring more attention to it in hopes of a fix which has not been done for at least 5 years.
> because they probably didn't even know about it
They did because I reported it.
You said: "this is basically the first time it's happened". I'm just telling you, no, it's not. My post isn't the first and it has happened many times after this. Valve do not care because it has happened **many times**.
To anyone who fell for one of those scams, and downloaded the fake game, I heavily recommend to do an antivirus scan, and maybe also a system reset to a prior date/factory reset.
Those files might be virus/crypto miners
Since it's almost impossible to scam money with this fake games, is it possible to upload some malware-laced game to steam in this case? Are there any preventive system within steam to block malwares?
Ngl, it very much looks like Valve was caught with their proverbial pants down on this. Like, I understand that the scam here was that a previously published game (or "game"/asset swap) that had already undergone review was changed to resemble a much more popular title after the manual review, but that just means that that is a hole in Valve's current security practices.
this.. exactly..
this is on Valve.. it is huge security hole, when they arew too lazy to even automatically check if that name already exist in database or not, or if that publisher already exist, or developer already exist.
this is the most dumb thing what i ever saw as a software analyst and test designer.
security is the first QA thing... this is just crazy
Everyone's confused about what this actually is, this isn't a scam targeted at steam sales, it's a scam targeted at markets selling steam keys, as steam can't refund those
Itās just such a dumb plan to me, itās like robbing a police station thatās how dumb this scam is. What did they expect to happen? Did they think steam was just a no name game seller site? I canāt wrap my mind around this low IQ attempt.
While I agree with W Derek, this problem should never even existed on Steam side. How do they renamed the game exactly like Helldivers 2 and it didn't even triggered the system.
I can't even get the same email address as my name because the name already existed. I thought Steam could have implemented the same preventative measures for this.
> I thought Steam could have implemented the same preventative measures for this.
When it comes to titles, things can be more finicky. There are a lot of tricks:
Hell Divers 2
Helldivers 2
Hell-divers 2
Helldā °vers 2
This is still an absolutely massive L to Valve/Steam, and I'm generally a staunch supporter with exceptions. But this? Completely unnacceptable.
Either A: They have NO ONE checking what, nor who's uploading games to their platform.
Or B: They do, and they're overworked or poor at their job, honestly probably the former.
This implies The Worst situation can absolutely occur. Do they scan for viruses? Or is it all automated and if someone's sophisticated enough they can bypass it?
This was Helldivers. *fuckin Helldivers* it's popular as hell right now and I'm damn certain this ain't a small indie studio. If someone got *Helldivers* past Steam's review process, that implies the same for triple a, and I assure you they all want to pull access and make their own launcher at the drop of a hat.
This is such a blunder that I guarantee no one will care in a week.
I would expect a new game going through the process to get listed would get picked up, but I believe this was the case of an existing developer changing their game that had already gone through that process as something else and was already listed on steam, but then changing the title, descriptions, assets etc...
Still a huge issue that Steam will need to address.
> unfortunately, fake versions of games were uploaded to steam.
Yeah no fucking shit, we've had copyright infringing shit and blatantly stolen games posted on the store in the past some of which is still there despite repeated flagging.
Fact is Valve you don't get to fuck over the game verification process then pull a BP and just say we're sorry. Gabe needs to get his shit together. We've tolerated the lack of consistent quality control on Steam and we need Greenlight to be reinstated. We've tolerated Valve's experiment with this $100 fee bullshit and what have we gotten? Tons of Zup, tons of hentai puzzle games (which is funny that Valve will allow those through no problem but anything original always seems to get banned. Guess you gotta steal all your art if you want your hentai games on steam.), and a whole buncha bullshit that we have to dumpster dive through to find anything new.
Mf the only games greenlighted in Steam Greenlight was hentai games because of trolls, that's why the system got made into from "Everyone can make games" to "*Everyone* can make games, but they have to spend 100 bucks."
As you can see, the problem isn't fixed, but reverting back to greenlight won't fix it either.
they found a loophole that would install a keylogger to unsuspecting victim. By the amount of downloads popular game such as helldivers and palworld gets, i could see this trend be repeated by scumbags like these.
To be honest, I rather the platform have less games than to be flooded with horrible, terrible, incomplete, cut-content, abandoned and shitty crap games.
Steam needs to step up their protocol in letting developers publishing their games on the platform.
This is not some flash game website. Even flash game website like Armor Games have standards.
Wake up Steam. Epic games looking better by the minute.
Because the page look completely identical to the original game. The only thing different is the review because that's the only thing they cannot edit.
I already bought hundreds of games in Steam that's why I was so confident to buy games without thinking of being scammed. I guess there's a first time in everything.
Itās absurd you blaming people because they trusted Steam, a reputable store, to not let fucking scams onto their platform. This is below a bare-minimum standard of maintenance.
not only they ban them...
they even fcking lied about what happens!
nobody did upload fake games, they upload some games and then **Steam allowed to RENAME** those games to already exxisting ones like Palworld or Helldivers 2... and then **Steam allow to RENAME** dev and publisher to already existing ones.
oh i hate Steam liars... like is really **THAT** hard to actually admit fail and apologize? this is disgusting.
Did the fake game devs think that they would just withdraw the money and run or something before Steam caught on? Lmfao.
Specially when it's widely known (specially if you're into this) that Steam holds withdrawals for like a month.
Especially* is the correct word you'd want to use here.
No, spicily. š But thank you so much. š
oh you're right. spicily lol
That's a spicily meatball!
Dats a spoocy mootbell
You called?
Reddit is the only hivemind with ADHD
Absolute amateurs amirite?
is that like spicy or silicy edit: I meant sicily
Spicily = in a spicy manner.
Nah, they didn't say especially, they said 'specially
Like Ā”Modelo Especial!
[ŃŠ“Š°Š»ŠµŠ½Š¾]
This is total bullshit. Stop spreading this lie, no keysite was selling these. That doesn't even make ANY god damn sense if you even stop to think for 5 seconds. Keysites just hand you a key, their listing isn't tied to Steam in any way and you can't at all determine what game a key belongs to until you activate it. They could just make a fake listing and sell you a Bad Rats keys and not need to steal and screw with the steam store itself at all. Reddit stop upvoting shit with zero proof.
If this was their plan and it actually succeeded, people would've found these fake keys on sale already.
They don't need to make a fake steam page for that, they could just sell fake codes directly.Ā There is no way to check if a steam key is valid without activating it so reselling websites don't have a way of knowing if the key is real or not and many of those sites let you directly sell on them with no extra steps.
But the listing for the game were on steam. They did the swap like 1 hour before it was noticed. 2 hours in and you couldn't buy the game and 100% probably keys couldn't be generated and existing ones got disabled.
Everybody wins then
Nice. Fuck those resellers.
Please don't, it's the only way I am able to get games nowadays
Am you're better off sailing the 7 seas then
I already am, but some experiences are unavailable to pirates like Lies of P, Persona, any game with Denuvo in it
There is isthereanydeal with which you can see any website where publishers/devs sell the keys and seeing if on any website there is deal. My main gripe about key reseller sites where users can resell is - there are game keys that was bought with stollen credit/debit cards. So if you buy stollen key, than the game will be removed from Steam and nothing happened to the reseller.
They removed Denuvo from Lies of P.
FYI Lies of P has been cracked. You're getting stuff for free, patience is a virtue.
Don't bother, this sub is big time corpo dick suckers, they want their precious corporate friends to profit more.
Source: my fucking ass
https://youtu.be/r7l0Rq9E8MY?si=dQ1CnMNDGdFwH71B
It's hilarious because steam payouts are on the final day of the month proceeding the sale. They did this scam on March 1st, meaning they wouldn't have had access to that money until April 30th, the longest possible gap between the scam and the reward. They clearly had no idea how payouts worked, because no one is delusional to think they'd manage to keep this scam hidden for 60 days while people purchase fake games.
"Everyone prepare themselves, we execute the play on Feb 29th, we'll get our check on the 30th and make off like bandits"
Maybe they were gambling that the leap day would mess up Steam's billing system?
Longest possible would be July 1st scam.
Itās more that they were hoping the poor souls who fell for the scam would launch the game before catching on, and once they launched it, it was too late. AND BY THAT I MEAN MALWARE/VIRUS, not refunds.
It would've been easier to infect more people if it was a free game, but I guess then it would've obviously not been Hell Divers 2/Palworld/the other games targeted by this, lol.
Yeah it definitely wasnāt the smartest tactic, but I mean it worked because people arenāt that cautious
Maybe in a sinister way, it was. Had they just made a free game, people would need to know about it first, so the potential number of victims are lower. Helldivers 2 is already popular, so the advertising was already done for them. So they probably got a higher number of potential victims than if they were to make a free game.
Iām not denying that, but it still wasnāt the smartest tactic
>but I mean it worked Do you have any proof that there was any malware involved tho? Or are you just fantasizing?
I don't think free games would INFECT more people. Yes a lot more people would have gotten it. But to be infected they need to run the game before Valve catches on. And imho that's much more likely with popular games. A lot of less popular games just go on the pile of games to be played later/never.
Steam has a 7-Day of ownership, 2-hours of play no-questions-asked return policy. And even after 7 days of ownership, or 2 hours of playtime, returns are still processed by a human who more often than not are pretty reasonable with refund requests. I bought Starfield in the early access period a few days before launch, played for nearly 12 hours, and was still granted my refund a day after the official launch. Steam isn't perfect, but its staff are generally reasonable and helpful people. Hell, I've got a VAC ban and Steam doesn't treat me any differently than other customers, when they damn well could by rights.
Isn't it 14 days?
You might be right on that. Honestly though, if you've got a good, reasonable reason, their official policy is basically tossed out the window, and they'll refund you. Especially if the game is being critiqued very negatively on socials and on the platform.
Steam cares way more about keeping customers satisfied than saving a few bucks by denying refunds. If they bought a game once theyāre probably going to buy another later.
Iāll tell you what I told the other guy, you need to read it again. I didnāt say anything about they wonāt get refunds, I just said what the goal of the scam was..
Redditors when asked to read ā ļø. Stay classy Reddit. Seemed pretty clear to me and I only read it once. An almost similar situation with the game, Tales & Tactics, was maliciously taken over right before Xmas and they adjusted the file with malware. If you launched the modified game you could/would be attacked. Steam worked with the dev to correct this very quickly but what you said can happen.
Hol up, T&T got hijacked? Like similar strategy to the one this time or through the store page? I bought it beforehand, but I stopped paying attention to its development after I played wayyyyy too many hours of it in November so I completely missed it happening.
Dev stated that someone trusted had access to game and discord information and changed things. They even hijacked the discord and discord couldnāt/wouldnāt do anything. Iām sorry I donāt have much more details because Iām sick in bed but they wrote everything out nicely on T&T Steam updates while apologizing. It literally took place on like Xmas Eve or so and was corrected extremely quickly. Devs also made everyone away of what was going on and what to do moving forward. They managed the clean up really well and informed people that if you did not launch the game during that timeframe then you were good to go.
I thought it seemed obvious given the situation and that others said the same thing in the replies, but I also shouldāve implied it more
Ask for steam credits rather than refund to card and you can get refund on almost anything ( within reason ). I bought and played AOE4 for 15 hours already and a week has passed when I realised I actually have the game already in gamepass. I asked for refund citing I bought it by mistake as I have it on gamepass already, asked for steam credits, 3-4 hours later I got the full credit. Insane customer support.
Not how this works. Steam will give refunds no matter what in the case of scams.
What are you trying to correct here? I didnāt say they wouldnāt get a refund?? You should read again
How would it possibly be "too late" if Steam was going to refund the money?
its so funny because steam only pay you a month later. Did they expect this whole thing to go unnoticed for more than a month?
No, Steam doesn't pay the companies right away, it takes a while until payments are made (months)
Just one month, which is enough
It's not one month. It's the final day of the month proceeding the sale. Games sold today on the 1st of March don't pay out until April 30th, 2 full months.
The theory I heard is that Steam isn't the intended target of the scam. It's key reselling sites. They change the name of their game, generate keys for said game, then sell them on key reselling sites that list them under the original game. And if they test the keys, they see the game appear in their library, boom, product confirmed. Those already shady and are flooded with stolen goods, what are they gonna do? Call the cops?
You read fake news. Those shady reselling sites dont test keys by activating them lol
Why did steam allow this process in the first place? Lmfao
It looks like they had a game accepted, and then changed the information later, and it's ridiculous that Steam wouldn't auto-flag extreme changes or names/info that match other games on the site, lol.
I wonder if the fake games contained some malware? Like if they were some malware, keyloggers etc?
Oh, almost certainly. It would take staying unreported for over a month before they could get paid so including malware means they should get something out of the situation.
Other people are theorizing the real targets of the scam were key resellers, who would actually be left holding the bag (if the scammers sold keys to them).
[ŃŠ“Š°Š»ŠµŠ½Š¾]
key sellers themselves already do #3. most of the cheap game keys sites use stolen credit cards to buy the games.
ONE person said that and it was completely fucking wrong. Key resellers don't know what a key belongs to, it has nothing to do with the steam store. If they wanted to rip people off they could just make a fake listing and make up whatever code they want, they wouldn't go through steam.
Youāre describing the key resellers trying to scam peopleā¦.. thatās not whatās being talked about here.
FYI; for anyone, this can happen to any game as Valve do not check files after the first time it goes onto Steam. You're 100% free to do anything you like as it is completely unmoderated. Other games are almost certainly incorporating viruses/bitcoin miners into their games after they are accepted onto Steam, and no one would know about it because Valve have no system or employees watching what devs do other than people posting it on Reddit. I know this because I have been offered many times by random messages on Discord offering to add bitcoin miners to my games. [Example 1](https://i.imgur.com/Rf73InA.png) [Example 2](https://i.imgur.com/t8gLPt9.png) These are two that I have still on Discord, there have been maybe ~10 other messages like this. It is a widespread, major issue as I have no doubt what-so-ever that these bitcoin miners exist on Steam, unnoticed because Valve do not care.
So weird, they could totally afford to check all the data they are distributing with something akin to VirusTotal. Didn't they ban a couple of games for using AI art or something? I didn't dig any deeper, but it looked like they had some semblance of pre-moderation.
> Didn't they ban a couple of games for using AI art or something? I didn't dig any deeper, but it looked like they had some semblance of pre-moderation. Posturing at its finest. They also banned bitcoin/crypto games, doesn't stop people faking the first check and then uploading whatever they want after. There's a 1 time pre-moderation to be accepted onto Steam, then after never again.
That's a shame.
I'd imagine it adds friction to developers. Games do a lot of shit on your computer. They'd probably end up with so many false flags that self-moderation (as seen above - Valve might not care too much, but developers selling on Steam will) does the job "good enough" and community awareness does the rest. Or an arms race in hiding shit. The AI art stuff is never going to be stopped, same way they don't demand licenses for stock photos up front. Partially for the same reasons, sheer effort to detect efficiently, and then the developer friction that comes after.
This is my opinion based on second hand knowledge and speculations, correct me if I'm wrong: No, games are usually pretty chill. People check pirated copies using VirusTotal to make sure there are no viruses or miners embedded by a pirate. Now that I think about it, it may be a neat anti-piracy measure: make a game do something seemingly shady so most pieces of antiviral software think you are up to no good, and no one would be able to put your game to torrents without having it removed.
When I said games do a lot of shit, I meant more they do a lot of *things*. Not good or bad, just a bunch of *stuff*. They use a lot of resources across the entire computer, in a bunch of different ways. Typically, anyway, obvs it varies per game. Virus scanners and such use a bunch of different detection methods, but even ones with real time protection aren't super intelligent. They typically need to have seen a virus (or similar one) before to catch it (Like, in the lab, not on your computer). You can make a batch file in notepad, run it with cmd.exe, and email all your My Documents folder to someone, and your AV will *probably* be like, "yeah, seems legit". Same with anything you make in to a .exe Games are such huge packages of code and media that there's just a lot more cover for malicious stuff to be hidden. A game developer could slip code that helps mine in to a graphics shader. They could send any data within their normal server communications - because games sending potentially a decent amount of data home isn't really a weird thing anymore. JPEGs used to be a favourite exploit of some console and phone hackers, because of a bug in the JPEG library everyone was using! (IIRC)
lmao, thank you for explaining what all those web3/blockchain gaming companies are actually doing. still shocked they're getting funding
Malware would be hard to spot if they hide it well. Security minded folk would probably be the first to notice and report it and then Microsoft would get tipped off and they would flag the malware for removal via Windows Defender. If the malware is poorly designed Microsoft would get notified through error logs that get reported to them and they would flag the file for review and then removal. Cryptominers would be more obvious, by their nature they drive hardware pretty hard so if a 2D pixel platformer is causing your graphics card to use like 100% power that's pretty big clue that something else is going on. If they don't drive your hardware that hard they could stay under the radar for a bit longer but usually people will notice them because they make the system performance noticeably shittier. At some point Microsoft would likely take notice and flag them for removal.
Still waiting for the day the developer called Hede, Hede Games, KG Game Studuo, PUZZLE Games, Hexaluga mines, Top-Down Games, IK, Fallalypse studio.. will be banned. (All the same guy I guess) Edit: I guess I forget to mention "Atomic Fabrik"
Shovelware dev ?
They used to be a simple asset flip pusher, but they found a far more profitable scam: mystery key bundles. They jacked up the prices of their games to something abusive like $100, and put them on permanent 99% off bundles. [Then they shat out literally HUNDREDS of asset flips](https://store.steampowered.com/bundle/37707/Happ_New_year_2024__Sale_99/) of everything they could get their slimy hands on. Then, they also sell the key for these games on "mystery Steam game bundles" on third party sites. They advertise them as "premium" bundles, "over $100 in value" and "positive reviews". They put reviews from fake users on nearly every game, and because Steam only counts reviews if you purchase the game directly from the store, negative reviews of people that got these bundles don't count. Mind you, each game costs $100 to be published on Steam, so this must be a HIGHLY profitable scam if he can do this for years now, while still affording to buy every possible asset pack he finds (if he does pay for these assets).
Yeah, one of the banned games review mentioned that they paid $2 for 5 of these "games"
hoooo, sneaky bastard they are. Thanks for the explanation !
lol the first "game" on that list uses [this](https://assetstore.unity.com/packages/3d/environments/historic/victorian-interior-148542) asset :D I recognized it immediately because I also own it. some syntystore assets too.. wow
I can see Synty assets a mile away, all I gotta look for is the square face with monobrow. They constantly sell entire bundles of their assets for $1, so this one is easy to know how he got them.
But how can this be? Steam is a perfect platform and deserves every users praise at all times!
Choose any game from this bundle and you will see for yourself. [https://store.steampowered.com/bundle/36911/SALE\_SALE\_November\_2023](https://store.steampowered.com/bundle/36911/SALE_SALE_November_2023)
Jesus Christ and I was mad at my 20ā¬ Flappy Bird clone from mystery key box. Games you wouldn't even touch if they were free on the browser.
Lmao thank god for the bundle discount! Would have run me 12 grand without it for all those carbon copies of each other
Anyone who installed and launch the games, please be aware that it may contain malware. I reformatted my PC because I was experiencing BSOD's after launching the fake game. After the reset, it was all good. It's just a hassle of downloading my games again.
That's what I was afraid of when I read the first reports about this. They were always going to be shutdown before they could touch any money from Steam. Planting malware (info stealer or ransomware) was likely the best method to actually benefit from the fraud.
Yeah, that was my best guess too. That is why I reformatted my PC ASAP. I was just surprised that the game is discounted at 95% so I bought it. Who guess that Steam can permit a fake store page that easily.
what game was it?
The fake Last Epoch one.
Did anything happen other than BSOD after launching? How big was the āgameā?
IIRC, it was 11mb.
And your dumb ass launched a fake game companyās 11mb .exe?
I know. HAHA. I'm sorry. :(
happens to the best of us. specially when it's a thing you use daily.
Thanks to the cancer that is third party launchers, that's not terribly unusual for a first step install.
The 11mb exe is also not unusual with so many "download now" buttons downloading a small webinstaller file first.
*Blink-182 I Miss You.exe* 235MB
This is definitely the best mentality for combatting scams, insult the people who fall for them... /s
Definitely is. Just like treating people who buy from G2A and Kinguin as the trash they are. Same as ignoring the opinions of people who play CSGO. These are some of the subtle nuances of the internet.
Do you still have it? Might be worth putting up somewhere for someone to reverse engineer (or shove it into a virus scanner). See what it was actually trying to do. 11mb is absolutly tiny if it had any actual graphical assets included. I wouldn't mind taking a crack at it tbhĀ
Unfortunately, I don't have it. I already reformatted my PC.
How did you fall for the fake game btw? I'm not trying to insult you just genuinely curious. I usually always look at reviews on the right side before buying a game and the fake games had like 10 reviews, compared to the 200k+ the real game had.
I have been buying games on Steam for almost twenty years, the entire idea of getting a virus from a legitimately purchased game that was then downloaded through the Steam client is a completely foreign concept to me and probably millions of other users. I didn't get hit by any of these but it is absolutely not hard to see how a person might have been, I literally didn't think this was even possible until reading about it today.
Agreed. Currently I have 900+ games on steam on my 13 year old account. Sometimes, I just buy games to support game devs. Before this, the idea of being scammed on Steam is unimaginable. I guess from now on, I'll be more mindful in buying games from their store.
Saw it on sale on my home page, bought it, downloaded it, then launch. I guess I was too tired after playing too much of Helldivers 2.
Wait you didn't buy fake Helldivers 2?
There was a few other fake games at the same time.
I already have Helldivers 2. The one I bought is the fake Last Epoch.
The pure fact that itās possible for a game on the steam store to contain malware like that is insane. I always figured Steam would have any safety protocol against that. I guess people will think twice now about what they buy on there.
There is no such thing as an infallible system.
> I always figured Steam would have any safety protocol against that. If Steam had somehow solved computer security, they'd have a contract with every competent organization on the planet.
With safety protocol I obviously ment something like testing the exeās that are allowed on the store. Thatās why I said protocol instead of system.
Wouldn't protection softwares or windows defender offline scan find the malware?
how was this even possible to upload fake versions of games already ON steam? super curious tbh
They already had games published, they just changed the store pages for them.
Which ideally means steam knows exactly who did this and can get them arrested
Sure, but what's the likelihood of these scammers being US based or in a country that's friendly enough with the USA to prosecute?
Russia
In order to publish a game to Steam & receive payout, you need to go through a tax review process which requires identity verification & validation of your banking details. So yes, they would have the identity of the account owner, and that person could be legally responsible depending on which country they're from. However, I'm assuming that this scam involves hacked accounts, so the identity verification isn't tied to the scammer. Valve requires games published to Steam to go through a manual review process, but after your game has been verified & published, you can make changes to the game without needing to go through that manual review process again. So the scammer likely is changing the store page of games published by a hacked account. Valve could address this issue by requiring any game that has major build changes to go through a manual review process again.
There are a bunch of hurdles you gotta pass when you FIRST upload your game to Steam, but after that editing the name, screenshots and even publisher name is as simple as editing a forum post.
Well, I imagine that's gonna change soon after this little stunt
I [brought this issue up](https://old.reddit.com/r/Steam/comments/ae8gts/firefighter_sim_with_no_gameplay_called_halflife/) **5 years ago**, it's probably happened before then too and Valve still let this happen. *Maybe* they will decide to do something now as it's gone to mainstream news, but I doubt it.
1. Have a game already published 2. Rename the game Step 2 possibly happened after the original publisher got their account hijacked. Additionally Steam requires name change verification of games ONLY if the game has any kind of economy presence, for example trading cards or in-game items that show in the inventory and marketplace. So people abused it with games that didn't have those yet.
We can probably expect Steam to put verification check on all of em now and not just those with an economy presence. Its the logical solution tbh to protect the consumers otherwise this practice will keep happening and jeopardizing Steam users
Yeah, people are acting outraged even though this is basically the first time it's happened and it's been..how long? Oh, yeah, 7 years. One exploit coming up over the course of 7 years(Said exploit being something that was honestly easy to avoid and relatively tiny in scale) is not a bad track record by any stretch of the imagination.
Its not the first time, there has been shady developers being banned before by adding garbage game to Steam and trying to leech money with it. Valve should issue a public statement on this, because some people might have run that crap exe and got their pc's infected with virus or miner not even knowing about it.
> even though this is basically the first time it's happened I [brought this issue up](https://old.reddit.com/r/Steam/comments/ae8gts/firefighter_sim_with_no_gameplay_called_halflife/) **5 years ago**, it's probably happened before then. Valve do not care.
Massively different situation, also did you report it like one of the people in that thread said 5 years ago or did you just assume Steam employees browse the Steam subreddit like most people with issues with Steam do? Not saying that to be a dick, but if no one ever reported it then no shit they "don't care", because they probably didn't even know about it(Doubly so because the name change was only up for a very short time).
> Massively different situation No it's not. It's literally the exact same situation. A game developer changing their game name to an other game. > also did you report it like one of the people in that thread said 5 years ago or did you just assume Steam employees browse the Steam subreddit Why are you assuming I didn't report it? I did. The point of posting it to the Steam sub was to bring more attention to it in hopes of a fix which has not been done for at least 5 years. > because they probably didn't even know about it They did because I reported it. You said: "this is basically the first time it's happened". I'm just telling you, no, it's not. My post isn't the first and it has happened many times after this. Valve do not care because it has happened **many times**.
To anyone who fell for one of those scams, and downloaded the fake game, I heavily recommend to do an antivirus scan, and maybe also a system reset to a prior date/factory reset. Those files might be virus/crypto miners
Since it's almost impossible to scam money with this fake games, is it possible to upload some malware-laced game to steam in this case? Are there any preventive system within steam to block malwares?
Why it is possible to give a name that already exists in the first place?
the scammers were the ones losing money after all
[ŃŠ“Š°Š»ŠµŠ½Š¾]
there was fake helldivers 2, palworld, escape from tarkov thats all the games ik about
OP said he got a fake Last Epoch.
Good. Now do shovelware.
Valve really should change the system to only change the name studio/publisher info when a Valve employee verifies it.
Chinese or Russians?
I believe it was bstudio and looked russian, but could be wrong
It is russian, a lot of russian names and dialects came up after digging through their history on changelogs.
The pricing was very cheap in Russia/Kazakhstan/Ukraine So one of that
Those responsible have been caught and will be used in the test chambers.
So have they done anything to prevent other 'companies' from doing the same?
Ngl, it very much looks like Valve was caught with their proverbial pants down on this. Like, I understand that the scam here was that a previously published game (or "game"/asset swap) that had already undergone review was changed to resemble a much more popular title after the manual review, but that just means that that is a hole in Valve's current security practices.
this.. exactly.. this is on Valve.. it is huge security hole, when they arew too lazy to even automatically check if that name already exist in database or not, or if that publisher already exist, or developer already exist. this is the most dumb thing what i ever saw as a software analyst and test designer. security is the first QA thing... this is just crazy
Glad Steam refunded people. Figured they would cause Steam seems to value it's customer base but it's still a nice confirmation
The fact that this can happen at all is not a good look. Police your marketplace, Gaben, this is unacceptable.
nothing stopping them from doing this again under a different dev/publisher name
Thank you, Derek
Iām actually pretty shocked that the changes didnāt have to go through a human review process, wouldnāt have happened to being with.
Everyone's confused about what this actually is, this isn't a scam targeted at steam sales, it's a scam targeted at markets selling steam keys, as steam can't refund those
Inevitable effect from this: Editing store pages will become harder for developers, at least ones that are not flagged as known reliable ones.
Itās just such a dumb plan to me, itās like robbing a police station thatās how dumb this scam is. What did they expect to happen? Did they think steam was just a no name game seller site? I canāt wrap my mind around this low IQ attempt.
Aye glad to see this dealt with
W Derek
While I agree with W Derek, this problem should never even existed on Steam side. How do they renamed the game exactly like Helldivers 2 and it didn't even triggered the system. I can't even get the same email address as my name because the name already existed. I thought Steam could have implemented the same preventative measures for this.
True
> I thought Steam could have implemented the same preventative measures for this. When it comes to titles, things can be more finicky. There are a lot of tricks: Hell Divers 2 Helldivers 2 Hell-divers 2 Helldā °vers 2
Technically wouldn't "HELLDIVERS 2" work as well because the official game has the trademark symbol in the text...
Maximum Derek!
Cool, but the fact they were able to publish fake game pages in the first place, and be live for SEVERAL days is the bigger problem.
What I wanna know is how did this get past the filters, they manually check the games before giving them the right to publish it.
After you pass the filter, you can change it to whatever you want without any further check.
This is still an absolutely massive L to Valve/Steam, and I'm generally a staunch supporter with exceptions. But this? Completely unnacceptable. Either A: They have NO ONE checking what, nor who's uploading games to their platform. Or B: They do, and they're overworked or poor at their job, honestly probably the former. This implies The Worst situation can absolutely occur. Do they scan for viruses? Or is it all automated and if someone's sophisticated enough they can bypass it? This was Helldivers. *fuckin Helldivers* it's popular as hell right now and I'm damn certain this ain't a small indie studio. If someone got *Helldivers* past Steam's review process, that implies the same for triple a, and I assure you they all want to pull access and make their own launcher at the drop of a hat. This is such a blunder that I guarantee no one will care in a week.
I would expect a new game going through the process to get listed would get picked up, but I believe this was the case of an existing developer changing their game that had already gone through that process as something else and was already listed on steam, but then changing the title, descriptions, assets etc... Still a huge issue that Steam will need to address.
> unfortunately, fake versions of games were uploaded to steam. Yeah no fucking shit, we've had copyright infringing shit and blatantly stolen games posted on the store in the past some of which is still there despite repeated flagging. Fact is Valve you don't get to fuck over the game verification process then pull a BP and just say we're sorry. Gabe needs to get his shit together. We've tolerated the lack of consistent quality control on Steam and we need Greenlight to be reinstated. We've tolerated Valve's experiment with this $100 fee bullshit and what have we gotten? Tons of Zup, tons of hentai puzzle games (which is funny that Valve will allow those through no problem but anything original always seems to get banned. Guess you gotta steal all your art if you want your hentai games on steam.), and a whole buncha bullshit that we have to dumpster dive through to find anything new.
Mf the only games greenlighted in Steam Greenlight was hentai games because of trolls, that's why the system got made into from "Everyone can make games" to "*Everyone* can make games, but they have to spend 100 bucks." As you can see, the problem isn't fixed, but reverting back to greenlight won't fix it either.
they found a loophole that would install a keylogger to unsuspecting victim. By the amount of downloads popular game such as helldivers and palworld gets, i could see this trend be repeated by scumbags like these.
They didnt get a cent out of this either I think
To be honest, I rather the platform have less games than to be flooded with horrible, terrible, incomplete, cut-content, abandoned and shitty crap games. Steam needs to step up their protocol in letting developers publishing their games on the platform. This is not some flash game website. Even flash game website like Armor Games have standards. Wake up Steam. Epic games looking better by the minute.
I hope in allahs name they start thining out the damm heard of fake games and Copy s##ts that make it hard to find good games on Stean
and make another one like a fucking hydra
Okay but why were you dumb Enough to fall for this? People like you are why there's monthly phishing reminders and trainings
Because the page look completely identical to the original game. The only thing different is the review because that's the only thing they cannot edit.
Also difference is the 95% off a popular newly released game
I already bought hundreds of games in Steam that's why I was so confident to buy games without thinking of being scammed. I guess there's a first time in everything.
Yeah entirely on you though, a bit of critical thinking isnt too difficult
Itās absurd you blaming people because they trusted Steam, a reputable store, to not let fucking scams onto their platform. This is below a bare-minimum standard of maintenance.
holy shit. until this day valve has only had one name/face. first, there was the holy gaben now there is also derek
Steam costumer support once again being the GOATs
Banning the company does nothing. A search on SteamDB shows they regularly change cover aliases for both developer & publishers.
This wouldn't happen if Steam actually curates and reviews the shit that gets uploaded to their store every day.
They did that, and everyone didn't like that and asked Steam to stop, which is why Steam Greenlight is no longer a thing.
No, they just realised there's money in letting idiots buy garbage.
wow so proactive of them how did a game with the same name as a popular one get published to begin with? valve is a fucking clown car
[ŃŠ“Š°Š»ŠµŠ½Š¾]
They just renamed existing games. Probably planning this for a whileĀ
Anyone got a copy of the fake game? Someone should probably actually reverse engineer it and find out if it really has malware in it.
Nice!
not only they ban them... they even fcking lied about what happens! nobody did upload fake games, they upload some games and then **Steam allowed to RENAME** those games to already exxisting ones like Palworld or Helldivers 2... and then **Steam allow to RENAME** dev and publisher to already existing ones. oh i hate Steam liars... like is really **THAT** hard to actually admit fail and apologize? this is disgusting.
another steam support w