Victim's PC was infected with an infostealer (RedLine, Vidar, Raccoon, Lumma etc.). The malware silently extracted saved browser credentials, cookies, and autofill data. The thief receives a "log" — a package of all credentials from the infected machine — and extracts Steam/game accounts from it. Victim often has no idea the infection occurred.

Criminal bought leaked password databases (from previous breaches of other services) and ran automated tools to test email+password combos against Steam/game platforms. Works because users reuse passwords across sites. A single purchased breach database of millions of credentials may yield thousands of valid game accounts.

Victim was tricked into entering credentials on a fake Steam/game login page. Typically sent via trade offer links ("check this item price"), fake giveaway pages, or Discord/Telegram scam messages. Some campaigns use browser-in-the-browser (BitB) attacks that perfectly mimic real login popups, bypassing even user awareness training.

Account was previously purchased on LZT or similar market, used, and then re-listed for profit. Criminal may have: (1) checked game inventories (CS2, TF2, Rust, ARK, Rocket League) for tradeable items worth more than account price; (2) used the account to send scam messages to friends list; (3) used Steam Wallet balance then re-listed; (4) listed on external platforms (G2A, Skinbaron) via API — these marketplaces give "guarantees" and resellers know the account will sell for similar or higher price. Germany/EU accounts especially targeted for high-value game libraries and Skinbaron access.

Automated mass-registration of fresh accounts. Used for: bulk Discord/Telegram spamming (invite bombing, DM spam), fake review farms, CS2 cheating (new accounts per ban), boosting friends-list count for social engineering credibility, and flooding platforms with fake activity. Telegram autoreg accounts are particularly common — cheap, disposable, used for mass promotional spam and scam DMs.