Accepted Report: 76561198148072397 - ([CSGO] Counter-Strike: Global Offensive Items)

Scam Report

Report Type: [Other] Any other fraudulant behavior
Virtual item type involved: [CSGO] Counter-Strike: Global Offensive Items

Accused profile: 76561198148072397

Victim profile: 76561198015943761

What happened? Description:

Classic OP-skins / Google Chrome Extension scam attempt.
He told me to install a "Market Helper" extension (which has 0 downloads on Chrome Store, yet plenty of 5 star reviews xD, very convincing haha) and then he would buy my items on OPskins.

Good thing that OPskins has a HUGE warning message, informing everyone about THIS EXACT SCAM (Thanks OPskins <3!), so I don't see how this would EVER work lol :-D

Included are screenshots of:
- Entire chat
- His profile
- His profile with aliasses
- The Google Chrome extension

And I have also included the Chrome extension itself, so you can read the source code (don't worry, I have made it harmless by changing it into a zip archive). You can see it has several javascript files which hook into the OPskins and Steam inventory web pages, and snatch the OPskins security code.

I played along a little, I even "faked" having installed the chrome extension, by adding the green div that says "0 - items were stolen" using Google Chrome's Browser Tools (this one: http://i.imgur.com/1B8Chsv.png ), because he wanted "proof" that I had installed the extension and that none of my items were "stolen". I did the same for the Steam inventory because he kept trying to figure out why his extension wasn't "working" (I never installed it, LOL!, Gotta love trolling the scammers right ): http://i.imgur.com/0oeMofN.png

Here's the link to the malicious Chrome extension:
https://chrome.google.com/webstore/detail/market-helper/hbhanjcbnhdmafainnkmefodnhecnild​

Provide Evidence:

His profile:

View attachment 458805 View attachment 458806

The Chrome extension:

View attachment 458807

The chat (2 parts, with his profile on the right side):

View attachment 458808 View attachment 458813

And a zip file containing the chrome extension (I made it harmless, it's just javascript, you cannot run it).​

Always love to do this when they ask for a link, LOL:

I've posted the source code of the Chrome extension on Stackoverflow to get some help reverse-engineering it (unscrambling the code):
http://stackoverflow.com/questions/39211703/unscramble-javascript-could-be-russian-javascript

The source code has been unscrambled. Here's a screenshot of the most important parts:



People experienced in JS will quickly see that this script connects to http://sumscum.xyz over port 9595 and sends OPskin trade bot security tokens there. It also auto-accepts incoming trades (see part on the bottom).