{
  "schema": "phishdestroy.text-export.v1",
  "object_type": "Published page text and corresponding PDF digest",
  "id": "investigation_part2.html",
  "language": "en",
  "title": "Account access & accountability — The Steam Dossier",
  "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2",
  "source_html_sha256": "ef222dfe2c3ddd189a9c25f673e12adc8fa5705e4790451439583ab7fc7662aa",
  "exported_at": "2026-09-30T21:13:33.940Z",
  "scope": "Print reading edition. Research prose is retained; raster images and identified visual catalogues are replaced by source links. See editorial_scope for exact omissions. Support archive exports retain the core discussion and link the full gallery.",
  "editorial_scope": {
    "policy": "Research prose, conclusions, methodological limits and analytical tables retained without paragraph truncation. Named catalogues and visual galleries are linked; raster images are not embedded.",
    "linked_sections": [],
    "raster_images_replaced": 0
  },
  "license": {
    "identifier": "CC0-1.0",
    "url": "https://creativecommons.org/publicdomain/zero/1.0/",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb",
    "application": "Authored research materials; third-party materials retain their own rights."
  },
  "pdf": {
    "filename": "investigation_part2.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/pages/en/investigation_part2.pdf?v=print-20260930-links-v6",
    "sha256": "f8fa53f8dceddc00dd83e8e8a6401927695bf49b525bcc01fbb53ba2a220e78d",
    "bytes": 121568,
    "pages": 8
  },
  "integrity": {
    "signed_object": "investigation_part2.content.json",
    "scope": "The exact UTF-8 bytes of this JSON file. It contains the published text and identifies the corresponding PDF by SHA-256. It is distinct from the separately signed rights statement.",
    "signature_file": "investigation_part2.content.json.asc",
    "digest_file": "investigation_part2.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "verify": [
      "gpg --import pgp-key.txt",
      "gpg --verify investigation_part2.content.json.asc investigation_part2.content.json",
      "sha256sum -c investigation_part2.content.json.sha256"
    ]
  },
  "content": {
    "text": "Dieses Material ist auf Englisch verfügbar.Zurück zum Dossier · Deutsch ↗\n\nTHE STEAM DOSSIER / II\n\nPart II — Account Access, Outsourced Support & Enforcement\n\nPublic automation. Outsourced support. The people left counting the cost.\n\nBegin this subsection ↓\nEXHIBIT 01 / LIVE SHADOW MARKET SURVEILLANCE550,000+\n\nSteam accounts actively on sale on FSB Market (an anonymized label; the original name is withheld here)\nat this very moment\n\n550,000+ LIVE INVENTORY · 231,829 IN HISTORICAL SCRAPED CORPUS (198,320 STEALER LOGS)\n\nThe primary underground clearinghouse for hijacked Steam accounts, FSB Market (associated names withheld), authenticates both buyers and sellers using Valve's official Steam OpenID (openid.realm = https://FSB Market). At any given minute, over half a million stolen and compromised accounts (stealer logs from RedLine/Lumma, phishing captures, credential stuffing) are actively listed for pennies ($0.50–$2.00). Neither FSB Market nor the associated forum is blocked by Valve's Link Filter. This is the industrial reservoir supplying the 63.06% paid bot accounts that Valve bans without assisting the victim.\n\nLive Intel: Shadow Market Monitoring (550k+ Live) ↗ · Open capture record ↗ · Open Link Filter trace ↗550K+ LIVE\n\n01 / AN ECOSYSTEM WITH AUTHORS\n\nAutomation hasa paper trail.\n\nNamed projects. Published capabilities. Trace a tool to its documentation, then inspect the collected developer relationships.\n\n252REPOSITORIES COLLECTED\n3,320GITHUB PROFILES\n4,214PROFILE–REPOSITORY PAIRS\nValve infrastructureCommunity librariesReusable applications\nLines show documented integrations or dependencies. Select a node to follow its evidence.\n\nMulti-account automation / JustArchiNET\n\nArchiSteamFarm\n\nThe project explicitly advertises simultaneous card farming across Steam accounts. Its project file declares a SteamKit2 dependency.\n\nRead the project’s own documentation ↗\n\nSteamKit → ArchiSteamFarm\ndeclared dependency ↗\n\nCOLLECTED RELATIONSHIPS\n\n40 contributor labels · 40 forker labels\n\nContributor sample below. These labels describe the repository relationship, not employment or approval.\n\n@JustArchi@renovate[bot]@JustArchi-ArchiBot@dependabot-preview[bot] (unavailable)@renovate-bot@actions-user@dependabot-support@Abrynos\nWhat the developer graph establishes\n\nThe graph maps published contributor and forker relationships between named projects and GitHub profiles. These are public records — repository forks, contribution lists, profile associations. The question is what the paper trail of published capabilities and developer relationships requires Valve to answer, not what this investigation invented. Source hashes are saved in the map provenance.\n\nExplore the full network ↗Repository source data ↓\n\n02 / DIFFERENT CREDENTIALS. DIFFERENT POWERS.\n\nWhich keyare we talking about?\n\nPlaying a game does not require the player to issue a personal Web API key. That is the distinction at the centre of this inquiry.\n\n01 / USER ACCOUNT\nPersonal Web API key\nsteamcommunity.com/dev/apikey\n\nIssued from a user account for permitted API calls. Key creation, visibility, revocation and abuse detection are account-security questions.\n\n02 / GAME BACKEND\nPublisher Web API key\n\nSteamworks partners use publisher credentials for supported backend operations, including game-related services. A player’s personal key is a different credential.\n\n03 / IDENTITY & SESSION\nOpenID / session tokens\n\nOpenID confirms identity to a website. A Steam session or refresh token has a different purpose. These mechanisms should not be presented as one interchangeable “API key”.\n\nValve documents both user and publisher Web API keys. The entire Web API is therefore not separate from Steamworks. API key documentation ↗ archived 2026-09-15 ↗ · Game-session authentication ↗ archived 2026-08-29 ↗\n\nDOCUMENTED BY THE TOOL’S AUTHOR / MARCH 2024\n\nAutomation can use more than an API key.\n\nTrade Offer Manager’s wiki describes using a session access token for parts of the Web API when no separate API key exists. It also records mobile confirmation for key creation from late 2023. The maintainer calls token use this way unsupported by Valve; this is a dated documentation claim, not a live bypass test.\n\nInspect the maintainer’s explanation ↗ archived 2026-09-24 ↗\n\nTHE HUMAN SIDE / AN ILLUSTRATIVE PHISHING PATH\n\nStill playing.Already exposed.\n\nA message from a friend. A request to vote. A “thank you” page. To the player, the task is finished. A compromised session can outlast that moment.\n\nON THE PLAYER’S SCREEN\n\nF\nA FRIEND’S ACCOUNT\n\n“Can you vote for our team?”\n\nThe request arrives through Steam chat from a familiar account. In this scenario, the linked page opens in the client’s browser.\n\nOUT OF SIGHT\n\nThe trust starts before the website.\n\nA hijacked friend’s account can lend credibility to a phishing link. The surrounding Steam interface does not certify the destination website.\n\nFAMILIAR SENDER / EXTERNAL DESTINATION\nAccount security is the issue before any item is sold.\n\nThe player did not set out to create an automation credential or delegate control. Returning to a game is not evidence that the account is safe. Valve holds the session logs, the API key creation record, and the device correlation data. The victim does not. That asymmetry is the accountability problem.\n\nSession access and credential types\n\nAn API key and a logged-in session are separate credentials with different capabilities. Revoking a key does not terminate an active session. Valve’s own documentation describes both; Valve holds the logs that would show which credential was active at the time of any disputed action. The demand is disclosure of that record — not an inference the investigation has invented. Maintainer documentation on token handling ↗ archived 2026-09-24 ↗ · Valve key documentation ↗ archived 2026-09-15 ↗\n\n03 / THE OFFICIAL MARKET HAS A CEILING\n\nThe item can be rare.The limit stays.\n\nA price above the listing cap cannot be realised through one Community Market listing at that full price.\n\nILLUSTRATIVE ASKING PRICE$5,000Change the item’s asking price\n$100$20,000\n\nAn illustration of the published limit, not a valuation or recommendation to trade.\n\nLISTING CAP≈ $1,800\nWALLET CAP≈ $2,000\n\nAbove the published listing cap.\n\nWallet funds cannot be withdrawn to a bank account. These constraints create the demand that third-party skin markets fill: a demand the listing and wallet caps produce, while Valve's own rules prohibit commercial operators from meeting it.\n\nSteam’s market limits ↗ archived 2026-09-21 ↗\n\n04 / INSIDE THE SUPPORT BOUNDARY\n\nEntrusted with data.Accountable for access.\n\nValve’s privacy policy expressly provides for sharing personal data with third-party support providers, as necessary for support.\n\nTHE PLAYERAccount & evidence\n→\nVALVERecovery process\n→\nSUPPORT PROVIDERDelegated access\n\nPrivacy Policy §5.2 ↗ · Valve's own policy authorises third-party support access. The open questions are: what permissions were granted, what audit trails exist, and what happened when access was allegedly abused.\n\n2015\nThe scale was public\n\nValve acknowledged widespread account theft and described protective measures.\n\nValve publication ↗archived 2026-08-09 ↗\n2015\nValve outsourced the desk — and said so\n\nValve keeps a small in-house Steam Support Leadership team and stated it \"hired a couple different companies\" to handle support (Erik Johnson, Valve, to Kotaku); its privacy policy § 5.2 authorises those third parties' access to user data. Which contractor holds account-recovery access, Valve has never disclosed — community discussion names vendors such as Concentrix, but none is Valve-confirmed. The outsourced desk was in place years before either admission below.\n\nKotaku: Valve on its support ↗archived 2025-07-11 ↗\n2023\nThe first admission\n\nValve's CS:GO team accepts responsibility in writing for an account compromised through its own help-request process, and reverses the trades.\n\nOpen the outsourcing case ↓\n2025\nThe second admission\n\n33 months later, Steam Support writes that a technician \"failed to follow our process which resulted in your account restored to someone else.\" Same channel. Same outcome.\n\nDexerto, 14 Nov 2025 ↗\n\nCASE FILE / HFB & THE OUTSOURCING ALLEGATIONS\n\nThe way in was Steam Support itself.Valve said so in writing.\n\nIn the support reply reproduced by Dexerto, Valve's CS:GO team accepts responsibility for an account compromised through the help-request process — its own channel, not a phishing page and not the user. The items were recovered and the trades reversed, which is the remedy Valve tells other victims does not exist. HFB's inventory was reported at $2,000,000+ on the day and $3,000,000+ in the follow-up; Qkss lost $1,000,000+ the same way and got nothing.\n\nSUPPORT REPLY / REPRODUCED BY DEXERTO · 21 FEB 2023\n“compromised through a support help request, for which the CS:GO team takes responsibility”\nRead the reporting and reproduced message ↗ archived 2025-08-18 ↗\n01 / WHAT VALVE ADMITTED\nIts own support channel was the way in\n\nThe reply covers the compromised account and the reversal of its trades. Valve reversed them — so the trades were reversible. The original authenticated ticket is not in this collection.\n\n02 / WHAT THE SACKINGS DID NOT FIX\nThe same door opened again in November 2025\n\nThe contractor dismissed its entire Steam-support staff — reported by Mzkshow via Dexerto, not a Valve personnel statement. Thirty-three months later Steam Support wrote to another collector that \"a support technician that handled the help request failed to follow our process which resulted in your account restored to someone else.\" Valve's own sentence, about the same channel.\n\nThe second admission, 14 Nov 2025 ↗\n03 / WHAT IS OPEN\nValve has never named the contractor\n\nNeither the contractor nor the location is established by these sources. That is not a hole in the reporting — it is a disclosure Valve has not made about who held access to user accounts.\n\nContemporary account of the case ↗\n\nThree questions Valve has not answered: who could override account recovery, what the access audit found, and what changed afterwards.\n\nLater allegations in the preserved support archive\n\nTwo 2024 Reddit posts relay further Mzkshow investigations — a July 2024 VAC-ban removal case and a December 2024 $13,000 inventory case. These are separately reported incidents. The accountability question in each is identical: who had override access, what did the audit find, and what changed.\n\n14 July 2024 · reported recovery / VAC-ban case ↗2 December 2024 · reported $13,000 inventory case ↗archived 2025-08-05 ↗Two preserved posts, source rows & hashes ↓\n\n05 / FOLLOW THE LOSS\n\nEvery amountneeds a case.\n\nTen cases, June 2022 to March 2026. Every amount is the figure its named source published — $6,300,000, $2,000,000+, $1,000,000+, ≈$320,000, ≈$300,000, and down to €288. Valve holds the transaction log, the session record and the support audit trail for each one, and has produced none of them.\n\nSUPPORT CHANNEL21 JUN 2022\n$2,000,000+\nHFB — the largest inventory in the game\n\nREPORTED INVENTORY VALUATION · RAISED TO $3M+ IN THE FEB 2023 FOLLOW-UP\n\nSeven Souvenir Dragon Lores and the #1 Blue Gem Karambit, that knife alone at about $1.26m. Dormant three years with the authenticator still on; email and password changed through the support recovery route. Valve reversed the trades — and put its responsibility in writing. Before the reversal a reported $200,000+ of proceeds had already been withdrawn through market.csgo.com, which settles in cash and crypto. A reversal returns a skin, not the money someone already banked. The rollback also broke: a buyer hid his Souvenir Dragon Lore in an in-game Storage Unit, the script could not see inside its own container, and Valve duplicated a $130,000 item while undoing a theft — caught by item IDs and community reporting, deleted in July 2022, buyer refunded by BUFF rather than Valve.\n\nDexerto, day of the theft ↗\nWALLET & PURCHASES07 JUL 2022\n>$500\n44 disputed Market purchases\n\nCLAIMED WALLET SPENDING · USD\n\nA user reports unauthorized purchases of low-value Dota 2 items and an unsatisfactory support response.\n\nRead the complaint & linked screenshots ↗\nPLATFORM BREACH14 AUG 2022\n$6,300,000\nCS.Money — 19,000+ skins out of the bots\n\nPRICED VALUATION · FIRST ESTIMATE $1.6M\n\nAttackers took the mobile-authenticator files of the marketplace’s trading bots and emptied them, seeding part of the haul to well-known traders to blur the trail. Community researchers mapped 55 attacker accounts within hours. Valve reversed nothing — a third-party site sits outside Steam, said the same Steam whose inventory, trade API and account system carried the theft end to end.\n\nRead the contemporary account ↗\nSUPPORT CHANNELREPORTED 21 FEB 2023\n$1,000,000+\nQkss — same door, same actor, opposite answer\n\nREPORTED INVENTORY VALUATION\n\nTaken the way HFB was taken, by the same actor, through the same support help request. HFB was made whole eight months earlier. Qkss was not. Nothing in the published record separates the two cases except the size of the audience.\n\nDexerto on the Mzkshow investigation ↗\nSUPPORT CHANNELREPORTED FEB 2023\n≈ $320,000\nThe insider trade itself — one year of it\n\nPROCEEDS OVER ROUGHLY ONE YEAR · NOT AN INVENTORY VALUATION\n\nSupport-side access reached account history up to 15 years old: the first CD key, the first email, the first card — exactly the evidence the recovery process asks for. Whoever holds the database always wins that argument against whoever holds the account. One stolen M4A4 Howl with iBUYPOWER and Titan Katowice 2014 holos sold for $35,000 and ended up with NAVI’s b1t, who had no way of knowing. The contractor’s answer was to dismiss every employee working Steam support.\n\nEscorenews on the same investigation ↗\nWALLET & PURCHASES09 DEC 2023\n€288\nWallet loss despite two-step protection\n\nTRUSTPILOT · SOURCE INDEX 16\n\nThe reviewer reports a hacked account and a refusal to help with Market spending. The export has no individual review URL.\n\nInspect the source provenance ↗\nACCOUNT RECOVERY02 DEC 2024\n$13,000\n“Matvey” — two years after the sackings\n\nAUTHOR’S INVENTORY ESTIMATE\n\nRecovery granted to someone who supplied account data the owner himself could not match. Same route, same result, after the contractor had cleared out its Steam support desk.\n\nRead the preserved allegation ↗\nACCOUNT RECOVERY09 MAY 2025\n≈ $10,000\nRecovery through someone else’s ticket\n\nCLAIMED ITEM LOSS · USD\n\nA Quebec user alleges support reset the password and removed account protection following another person’s request.\n\nRead the first-person complaint ↗\nSUPPORT CHANNEL13 NOV 2025\n≈ $300,000\nHawkeye337 — and Valve’s second written admission\n\nFULL KATOWICE 2014 HOLO COLLECTION\n\nThe attacker demanded 1 bitcoin and began scraping the collection onto Negevs to destroy it. Steam Support’s reply: “a support technician that handled the help request failed to follow our process which resulted in your account restored to someone else.” Thirty-three months after the first admission, the same door. Restored within hours of the thread trending on X. Qkss did not have that audience.\n\nDexerto, 14 Nov 2025 ↗\nWALLET & PURCHASES29 MAR 2026\n$50\nUnauthorized top-up and gifted games\n\nTRUSTPILOT · SOURCE INDEX 290\n\nThe reviewer alleges unauthorized spending and unsuccessful refund requests. The individual review URL is missing from the export.\n\nInspect the source provenance ↗\n\nAttribution and amounts remain as reported by each source. Valve holds the transaction logs, session records and support audit trail for every one of these cases. Produce them. A preserved Reddit post does not settle the question — Valve's own records do.\n\nTHE COLLECTION / AFTER CHECKING\n\n231,829 accounts on sale.Valve holds the logs for every one.\n354 → 201\nTrustpilot records\n\n153 duplicate rows removed. Individual review URLs were not preserved in the export.\n\n231,829\nSteam account listings\n\n33,509 classified as autoregistered; 198,320 under the collector’s stealer label. Listings are not completed sales.\n\nCollection audit ↓Search the source archive ↗",
    "headings": [
      {
        "level": 1,
        "id": null,
        "text": "Part II — Account Access, Outsourced Support & Enforcement"
      },
      {
        "level": 2,
        "id": null,
        "text": "Automation hasa paper trail."
      },
      {
        "level": 3,
        "id": null,
        "text": "ArchiSteamFarm"
      },
      {
        "level": 2,
        "id": null,
        "text": "Which keyare we talking about?"
      },
      {
        "level": 3,
        "id": null,
        "text": "Personal Web API key"
      },
      {
        "level": 3,
        "id": null,
        "text": "Publisher Web API key"
      },
      {
        "level": 3,
        "id": null,
        "text": "OpenID / session tokens"
      },
      {
        "level": 3,
        "id": null,
        "text": "Automation can use more than an API key."
      },
      {
        "level": 2,
        "id": null,
        "text": "Still playing.Already exposed."
      },
      {
        "level": 3,
        "id": "session-hidden-title",
        "text": "The trust starts before the website."
      },
      {
        "level": 2,
        "id": null,
        "text": "The item can be rare.The limit stays."
      },
      {
        "level": 2,
        "id": null,
        "text": "Entrusted with data.Accountable for access."
      },
      {
        "level": 3,
        "id": null,
        "text": "The scale was public"
      },
      {
        "level": 3,
        "id": null,
        "text": "Valve outsourced the desk — and said so"
      },
      {
        "level": 3,
        "id": null,
        "text": "The first admission"
      },
      {
        "level": 3,
        "id": null,
        "text": "The second admission"
      },
      {
        "level": 3,
        "id": null,
        "text": "The way in was Steam Support itself.Valve said so in writing."
      },
      {
        "level": 4,
        "id": null,
        "text": "Its own support channel was the way in"
      },
      {
        "level": 4,
        "id": null,
        "text": "The same door opened again in November 2025"
      },
      {
        "level": 4,
        "id": null,
        "text": "Valve has never named the contractor"
      },
      {
        "level": 2,
        "id": null,
        "text": "Every amountneeds a case."
      },
      {
        "level": 3,
        "id": null,
        "text": "HFB — the largest inventory in the game"
      },
      {
        "level": 3,
        "id": null,
        "text": "44 disputed Market purchases"
      },
      {
        "level": 3,
        "id": null,
        "text": "CS.Money — 19,000+ skins out of the bots"
      },
      {
        "level": 3,
        "id": null,
        "text": "Qkss — same door, same actor, opposite answer"
      },
      {
        "level": 3,
        "id": null,
        "text": "The insider trade itself — one year of it"
      },
      {
        "level": 3,
        "id": null,
        "text": "Wallet loss despite two-step protection"
      },
      {
        "level": 3,
        "id": null,
        "text": "“Matvey” — two years after the sackings"
      },
      {
        "level": 3,
        "id": null,
        "text": "Recovery through someone else’s ticket"
      },
      {
        "level": 3,
        "id": null,
        "text": "Hawkeye337 — and Valve’s second written admission"
      },
      {
        "level": 3,
        "id": null,
        "text": "Unauthorized top-up and gifted games"
      },
      {
        "level": 2,
        "id": null,
        "text": "231,829 accounts on sale.Valve holds the logs for every one."
      },
      {
        "level": 3,
        "id": null,
        "text": "Trustpilot records"
      },
      {
        "level": 3,
        "id": null,
        "text": "Steam account listings"
      }
    ],
    "links": [
      "https://phishdestroy.io/steam_dossier/de/investigation_part2.html",
      "https://phishdestroy.io/live-intel/?category=steam",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-evidence-lzt.json",
      "https://github.com/JustArchiNET/ArchiSteamFarm",
      "https://github.com/JustArchiNET/ArchiSteamFarm/blob/main/ArchiSteamFarm/ArchiSteamFarm.csproj",
      "https://github.com/JustArchi",
      "https://github.com/apps/renovate",
      "https://github.com/JustArchi-ArchiBot",
      "https://github.com/renovate-bot",
      "https://github.com/actions-user",
      "https://github.com/dependabot-support",
      "https://github.com/Abrynos",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/automation-map.json",
      "https://phishdestroy.io/steam_dossier/de/output_steam_network/network.html",
      "https://phishdestroy.io/steam_dossier/output_steam_network/raw_data.json",
      "https://partner.steamgames.com/doc/webapi_overview/auth",
      "https://web.archive.org/web/20260915025812/https://partner.steamgames.com/doc/webapi_overview/auth",
      "https://partner.steamgames.com/doc/webapi/ISteamUserAuth",
      "https://web.archive.org/web/20260829124950/https://partner.steamgames.com/doc/webapi/ISteamUserAuth",
      "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
      "https://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens",
      "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
      "https://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B",
      "https://store.steampowered.com/privacy_agreement/",
      "https://store.steampowered.com/oldnews/19618",
      "https://web.archive.org/web/20260809125516/https://store.steampowered.com/oldnews/19618",
      "https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223",
      "https://web.archive.org/web/20250711004653/https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223",
      "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/",
      "https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
      "https://web.archive.org/web/20250818113925/https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/",
      "https://lis-skins.com/ru/blog/krupneisaia-mosenniceskaia-sxema-v-istorii-steam/",
      "https://www.reddit.com/r/cs2/comments/1e38jo4/stealing_accounts_and_removing_vac_bans_a_new/",
      "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
      "https://web.archive.org/web/20250805141942/https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json",
      "https://www.dexerto.com/csgo/over-2-million-in-csgo-skins-stolen-from-hacked-steam-account-1853092/",
      "https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/",
      "https://esportfire.com/article/the-biggest-hack-in-csgo-history-csmoney-14082022",
      "https://escorenews.com/en/csgo/news/44087-valve-steam-support-employee-accused-of-selling-inactive-accounts-inventories-worth-six-figures-b1t-has-one-of-these-skins",
      "https://phishdestroy.io/steam_dossier/PART2_RESEARCH.md",
      "https://www.reddit.com/r/GlobalOffensive/comments/1h56shi/steam_support_is_stealing_accounts/",
      "https://www.reddit.com/r/legaladvice/comments/1kipjde/got_10k_stollen_from_steam_inventory_due_to_steam/",
      "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-quality-review.json",
      "https://phishdestroy.io/steam_dossier/de/steam_evidence_archive.html"
    ]
  }
}