14 DAY TRIAL // Cyber-crooks are taking advantage of the new Steam trade escrow system introduced yesterday and are spreading malware using websites that promote a workaround for the trading limitation.
Since mid-November, Steam has been touting its new trade escrow system designed to limit scams and fraudulent trade operations. The system, which went live yesterday, introduced a few changes in how regular Steam trades take place.
If two users want to make a trade, the exchanged objects are held in escrow (set aside) for three days. Steam operators introduced this temporary trade hold-off as a way to prevent bots from making transactions and allow users to find out if they initiated the transactions or were tricked into doing so.
Cyber-crooks taking advantage of gullible gamers
As you can imagine, many people hated the idea, and some of them even started online petitions to prevent Steam from launching the service.
It's this dislike for the new Steam trade escrow system that cyber-crooks are now exploiting.
According to security vendor Malwarebytes, there are sites that offer workarounds for Steam's trade escrow system, promising users immediately executed transactions.
The only catch is that users download a special executable and run it on their computer, which, of course, contains malware.
To bring down the user's defenses even more, the trading website is even made to resemble the official Steam UI.
There's no Steam trade escrow workaround
If the user falls for this trick and goes through the process of selecting objects to trade, approving the transaction, downloading the Escrow.exe file, and then running it, they'll be infected with Backdoor.NanoCore.
This virus has a detection rate of 6 out of 55 on VirusTotal and allows attackers access to infected computers via commands sent from a C&C (command and control) server.
Gamers are advised to stay away from the csgoshuffle-trade[DOT]com website and any other similar service that promises workarounds for Steam's new trading system.
