{
  "compartment_id": "section-7",
  "number": "Section 7",
  "title_local": "Steam Web API endpoints used in the hijack pattern",
  "title_english": "Steam Web API endpoints used in the hijack pattern",
  "source_url": "https://phishdestroy.io/steam_dossier/#api-reference",
  "source_document": "index.html",
  "content": {
    "html": "<section class=\"border-t border-gray-800 pt-6 avoid-break\" id=\"api-reference\">\n<div class=\"max-w-7xl mx-auto space-y-8\">\n<div class=\"section-head section-head-balanced\"><div class=\"section-head-primary\">\n<span class=\"kicker\">Part A — Technical record · Section 7</span>\n<h2>The endpoints behind the sequence.</h2>\n\n<section class=\"dossier-note chapter-context\"><div class=\"dossier-note-title\">Context &amp; source limits</div><p class=\"chapter-context-text\">These are the Steam Web API endpoints that the reported hijack scripts used to intercept trades without passing through the browser-side confirmation steps.</p></section>\n</div><div class=\"section-head-intro\"><p class=\"lede\">Four documented endpoints do the whole job. None of them is a flaw, none needed exploiting — a valid key calls them and Steam answers. <strong class=\"text-white\">The key is the only thing the attacker had to steal.</strong></p></div></div>\n<div class=\"grid grid-cols-1 lg:grid-cols-2 gap-6 items-stretch font-mono text-xs\">\n<div class=\"h-full bg-gray-900/20 border border-gray-800 rounded-xl p-5 space-y-3\">\n<div class=\"flex justify-between items-center border-b border-gray-800 pb-2\">\n<span class=\"text-red-400 font-bold uppercase tracking-wider\">IEconService / GetTradeOffers / v1</span>\n<span class=\"bg-yellow-500/10 text-yellow-500 px-1.5 py-0.5 rounded text-xs\">POLLING</span>\n</div>\n<p class=\"text-gray-400 leading-relaxed text-[11px]\">\n                            Used to monitor the account's trade offers. Scripts poll this endpoint repeatedly with the compromised API key; it returns the details of newly created, pending or modified trade offers. Polling intervals are not measured here.\n                        </p>\n<div class=\"bg-black/40 p-2.5 rounded text-xs text-gray-400\">\n<strong>Threat vector:</strong> Discloses pending trade offer IDs and the recipient's profile details.\n                        </div>\n</div>\n<div class=\"h-full bg-gray-900/20 border border-gray-800 rounded-xl p-5 space-y-3\">\n<div class=\"flex justify-between items-center border-b border-gray-800 pb-2\">\n<span class=\"text-red-400 font-bold uppercase tracking-wider\">IEconService / CancelTradeOffer / v1</span>\n<span class=\"bg-red-500/10 text-red-500 px-1.5 py-0.5 rounded text-xs\">INTERACTION</span>\n</div>\n<p class=\"text-gray-400 leading-relaxed text-[11px]\">\n                            Used to programmatically invalidate the user's legitimate trade offer. Before 2023 no step-up authentication protected the key, so an automated server could cancel an offer as soon as it was detected, without any prompt to the account holder.\n                        </p>\n<div class=\"bg-black/40 p-2.5 rounded text-xs text-gray-400\">\n<strong>Threat vector:</strong> Voids the trade before the account holder completes the mobile confirmation.\n                        </div>\n</div>\n<div class=\"h-full bg-gray-900/20 border border-gray-800 rounded-xl p-5 space-y-3\">\n<div class=\"flex justify-between items-center border-b border-gray-800 pb-2\">\n<span class=\"text-red-400 font-bold uppercase tracking-wider\">ISteamUser / GetPlayerSummaries / v2</span>\n<span class=\"bg-blue-500/10 text-blue-500 px-1.5 py-0.5 rounded text-xs\">RECON</span>\n</div>\n<p class=\"text-gray-400 leading-relaxed text-[11px]\">\n                            Queried to retrieve the profile name, avatar image URL and level of the legitimate trade recipient. This lets the script dress a prepared clone account to match. No timing is measured here.\n                        </p>\n<div class=\"bg-black/40 p-2.5 rounded text-xs text-gray-400\">\n<strong>Threat vector:</strong> Supplies the data needed to impersonate the intended recipient.\n                        </div>\n</div>\n<div class=\"h-full bg-gray-900/20 border border-gray-800 rounded-xl p-5 space-y-3\">\n<div class=\"flex justify-between items-center border-b border-gray-800 pb-2\">\n<span class=\"text-red-400 font-bold uppercase tracking-wider\">/dev/ajaxregisterkey</span>\n<span class=\"bg-purple-500/10 text-purple-500 px-1.5 py-0.5 rounded text-xs\">CREATION</span>\n</div>\n<p class=\"text-gray-400 leading-relaxed text-[11px]\">\n                            Steam's registration endpoint for keys. Historically, any active browser cookie session (`steamLoginSecure`) could register a key without a Steam Guard confirmation on the mobile device, and without any notification to the account holder.\n                        </p>\n<div class=\"bg-black/40 p-2.5 rounded text-xs text-gray-400\">\n<strong>Threat vector:</strong> A persistent credential created by a script, unseen by the account holder.\n                        </div>\n</div>\n</div>\n</div>\n</section>"
  },
  "original_content_sha256": "b0624aa246b40815c720ed4d670fa78ea7065a69285a76f741d4290efdde8143",
  "author_pseudonym": "Agent Amy",
  "schema": "phishdestroy.macro-fact.v1",
  "language": "en",
  "aggregator": "PhishDestroy",
  "exports": {
    "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_7_agent_amy.pdf",
    "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_7_agent_amy.json",
    "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_7_agent_amy.json.asc"
  },
  "integrity": {
    "signed_object": "steam_dossier_section_7_agent_amy.json",
    "signature_file": "steam_dossier_section_7_agent_amy.json.asc",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged."
  },
  "pdf": {
    "filename": "steam_dossier_section_7_agent_amy.pdf",
    "sha256": "8fbbacc01bc6cc5831c29f8c3e2b8be6573b869e8d6a492a7c83615d32813aef",
    "pages": 3
  }
}