Accepted 76561198087585719 (Deep in while!)

My account was hijacked, so since no trade was involved at my end, this may not conform exactly to the report template. However, looking at my backpack status and history clearly the other party has been shifting my items around very rapidly. Chaos recommended I should file this.

victim:
|steamID: kickbubblegum
|steamID32: STEAM_0:1:41416565
|steamID64: http://steamcommunity.com/profiles/76561198043098859
|customURL: http://steamcommunity.com/id/kickbubblegum
|steamrepURL: http://steamrep.com/profiles/76561198043098859

scammer (unsure if direct hijacker or third party, either way, it's clear what he's being trying to do):
|steamID: Deep in while!
|steamID32: STEAM_0:1:63659995
|steamID64: http://steamcommunity.com/profiles/76561198087585719
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561198087585719

Screenshots:
Original outpost trade: http://postimage.org/image/a6qvr2k1d/65860c1d/
Scan results: http://postimage.org/image/l9eakxv4t/fa9bd162/
Pre-hijack inventory page: http://postimage.org/image/6zp6jtg3r/5820c231/
Post-hijack inventory page: http://postimage.org/image/ynbfrpt9x/ff13c1f9/
Blank profile of scammer with 0 game hours: http://postimage.org/image/5j1b5od2l/ef95cfb4/

Description:
Posted on my outpost unusual trade (http://www.tf2outpost.com/trade/9385943) was a link that, it was claimed, contained information about how my unusual was scammed. In reality, scanning the two files within that archive showed that they contained viruses.
File 1:
https://www.virustotal.com/en/file/...c14926a27f616487b781837d/analysis/1364606011/
File 2:
https://www.virustotal.com/en/file/...c14926a27f616487b781837d/analysis/1364606128/
(If the original file that was linked to in my trade becomes unavailable, I have saved a backup copy for reference.)

Just when I was scanning, perhaps due to my being rather tired, I ran the file from within the archiver I was using precisely to avoid doing that. Very rapidly, my login was revoked and I received address and password change notices by e-mail. Checking tf2items reveals that my items were quickly traded away:

Current tf2items backpack: http://www.tf2items.com/id/kickbubblegum
Most recent historical tf2items backpack http://www.tf2items.com/id/kickbubblegum?time=1364545366

I've already got in touch with Valve Support, but I was hoping something could be done from this end. The same user has made about 100 more posts on outpost since last night: http://www.tf2outpost.com/user/314857.

Hope something can be done about this to stop it happening over and over.

Thanks, Kick.

Not sure if this helps but...

Using your old TF2items bp link, you'll find that just about all of your items were either deleted or traded to this user:

Possible Hijacker alt:
|steamID: #hatemyswag
|steamID32: STEAM_0:1:19281535
|steamID64: http://steamcommunity.com/profiles/76561197998828799
|customURL: http://steamcommunity.com/id/hatemyswag
|steamrepURL: http://steamrep.com/profiles/76561197998828799

http://imgur.com/ydNYF4f,KPTn76J,32XZxHA,NFfA36D,GIZcDZB,NdYjs5K,EKnHwlp,WrxVQ9q (it isn't just these items)

His profile says: "#Don't hate me , hate my swag!" the exact same description of this user, who has also been hijacking people (I think it's also worth noting that that niccito guy also has the same icon as the person who sent you that phishing link). I think these accounts are connected with each other somehow.

I'm not jumping to the conclusion that he was the one who hijacked you, but he seems suspicious. Also, could you screenshot the ticket you sent to Steam Support and screenshot your results when you get them?

Yes, that's extremely helpful to get started on tracking this person or people down. Nice work, thanks very much

I was also going to research the trade history, but this attack happened in the middle of the night, Saturday AM, and I was out all day Saturday, so I only just had time to post this report. I'll see what else can be done.

It's disturbing to see that those two accounts are showing 4 and 7 year-old histories, so it's possible either they've been at it for that long or they've taken those accounts from some legitimate users.

I've made a list tracing the tf2items histories of those items in my hijacked account most likely to have a high trade value.

Before reading on, can I ask: Now that I have some idea of a few people who have received items taken from my BP (i.e my three unusuals), what, if anything, should be done about it? I realise I don't have any way of showing my ownership of the items until Steam Support take action, but in theory I could make a fresh account and contact the receivers of my items to ask them what the seller said about the items and what prices they were sold at.

The list:

As A Filthy Streetrat noted, many of the items, but not necessarily the highest-value ones, went to http://www.tf2items.com/id/hatemyswag/ (STEAM_0:1:19281535). Most have already disappeared from that BP, but some were shown as still present there at the last BP update. I've noted the latest status of each item.

Heart Phantom
http://www.tf2items.com/item/1054276398
Traded from my hijacked account directly to LejTeCole (STEAM_0:1:35600842)
Still shown as present in BP.

Purple Energy Inspecteur
http://www.tf2items.com/item/1552498984
Traded from my hijacked account to hatemyswag, then finally to RecK (STEAM_0:1:40568059)
Still shown as present in BP.

Orbiting Fire Private Eye
http://www.tf2items.com/item/858785559
Traded from my hijacked account to hatemyswag, then finally to RecK (STEAM_0:1:40568059)
Still shown as present in BP.

Strange Kritzkrieg
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535).
No further trades but no longer present - possibly deleted.

Strange Gunslinger
http://www.tf2items.com/item/1297152016
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535).
No further trades but no longer present - possibly deleted.

Strange Machina
http://www.tf2items.com/item/1067763964
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Caber
http://www.tf2items.com/item/1552434858
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Sapper
http://www.tf2items.com/item/1052143266
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Huntsman
http://www.tf2items.com/item/1304437513
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Widowmaker (x2)
http://www.tf2items.com/item/1185094780
http://www.tf2items.com/item/1067161354
No further trade history visible, last shown in my account - possibly deleted.

Bill's Hat
http://www.tf2items.com/item/1489276560
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Festive Sandvich
http://www.tf2items.com/item/1552434747
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Festive Buff Banner
http://www.tf2items.com/item/1552434756
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
No further trades but no longer present - possibly deleted.

Strange Holiday Punch (x2)
http://www.tf2items.com/item/1269025404
http://www.tf2items.com/item/1552434622
Traded from my hijacked account to hatemyswag (STEAM_0:1:19281535)
The first was traded from my hijacked account to hatemyswag (STEAM_0:1:19281535) but is no longer present - possibly deleted.
No further trade history was visible for the second, which was last shown in my account - possibly deleted.

Strange Mantreads (x3)
http://www.tf2items.com/item/1158838238
http://www.tf2items.com/item/1158838238
http://www.tf2items.com/item/1274750588
The first and last of the three were traded from my hijacked account to hatemyswag (STEAM_0:1:19281535) but are no longer present - possibly deleted.
No further trade history was visible for the second, which was last shown in my account - possibly deleted.

Other items of mine still listed as present in the latest BP update of id/hatemyswag (just a sample, many more there):
http://www.tf2items.com/item/1552434421
http://www.tf2items.com/item/1552434881
http://www.tf2items.com/item/1552434543
http://www.tf2items.com/item/1552434495
http://www.tf2items.com/item/1552434635
http://www.tf2items.com/item/1552434869
http://www.tf2items.com/item/1552434139
http://www.tf2items.com/item/1552434283

TL;DR version of the above list (I couldn't edit): The first 3 items in that list and the last few briefly listed ones are the ones that have a currently viewable backpack location.

My main account got hijacked http://steamcommunity.com/id/onemanleft/ still waiting on steam support ticket and I am using this account for emergencies and I saw most of my items in http://steamcommunity.com/id/mrpiratea inventory. (Most noticeably The Rocket Medic strange black box.)When he got to my email through the very same phishing link of yours, I also probably got his real IP from Lithuania as well. All in all, I hope it works out for us

Thanks for the info, very helpful. That account does seem to have a lot in common with the already listed accounts. Please do let me know if you find other details. I'll keep an eye open at my end too.

Scammer alt update: a suspicious account renaming, links to two further alts and multiple other cases on steamrep
#onelove and #lifefor are still able to trade at the time of posting

1. Already named in original post: Deep in while! (STEAM_0:1:63659995), who posted malware on my outpost unusual trade

2. Suspicious renaming: The Account which received the items from my hijacked account (see my list above), originally named #hatemyswag and with the custom URL http://steamcommunity.com/id/hatemyswag, changed both its steam profile name and custom URL after my unusuals were sold. The steam profile name is now #onelove, and the URL is now http://steamcommunity.com/id/mrpiratea. The ID32 is unchanged: STEAM_0:1:19281535. The former name can be seen on the user's profile: http://postimg.org/image/bpdd1su87/e99a3b76/
This account is now marked as a scammer on SteamRep, but it has not yet been trade banned, and is going about acquiring a large number of earbuds. Many of my items are also still in this user's backpack.
Examples of my items still in this BP: high five, business casual, stranges: e. reward, degreaser, ambassador, knife,

3. Updated scammer alts with evidence of links:
Scammer alt #1 (updated after rename):
|steamID: #onelove
|steamID32: STEAM_0:1:19281535 (same as #hatemyswag)
|steamID64: http://steamcommunity.com/profiles/76561197998828799
|customURL: http://steamcommunity.com/id/mrpiratea
|steamrepURL: http://steamrep.com/profiles/76561197998828799
Links to #hatemyswag and #niccito profiles: It's the same account as #hatemyswag, the user whose account recieved most of my items, just renamed and with a fresh custom URL, but keeping the same Steam ID, and retains many of my items. Has the same profile text as marked scammer #niccito. Location: Lithuania
#onelove/hatemyswag profile screenshot: http://postimg.org/image/t7wgng35f/d421b194/
#onelove/hatemyswag profile screenshot showing former name: http://postimg.org/image/bpdd1su87/e99a3b76/
#niccito profile screenshot: http://postimg.org/image/8uy1kqkkh/
Trade status: not trade banned

Scammer alt #2:
|steamID: #niccito
|steamID32: STEAM_0:0:9579843
|steamID64: http://steamcommunity.com/profiles/76561197979425414
|customURL: http://steamcommunity.com/id/nicccito
|steamrepURL: http://steamrep.com/profiles/76561197979425414
Links to first Deep in While and #hatemyswag/#onelove profiles: has the same profile picture as Deep in While, and the same profile text as #hatemyswag/#onelove. Location: Lithuania.
#niccito profile screenshot: http://postimg.org/image/8uy1kqkkh/
Deep in while profile screenshot (same picture): http://postimg.org/image/4ak37jnaz/25defa7e/
#hatemyswag/#onelove profile screenshot (same text): http://postimg.org/image/t7wgng35f/d421b194/
Trade status: banned

Scammer alt #3:
|steamID: #lifefor
|steamID32: STEAM_0:1:51069860
|steamID64: http://steamcommunity.com/profiles/76561198062405449
|customURL: http://steamcommunity.com/id/iloveyoumen
|steamrepURL: http://steamrep.com/profiles/76561198062405449
#lifefor profile screenshot: http://postimg.org/image/w261k4qh3/74b73cee/
#lifefor friends list showing #onelove and #niccito: http://postimg.org/image/3v34zbmk7/c55c6931/
Evidence of profile links to other profiles: http://forums.steamrep.com/threads/76561197998828799-hatemyswag.26294/ mentioned the close connection of lifefor to #hatemyswag. In friends list of both #niccito and #onelove. Left rep for #niccito. All three list location as Lithuania.
Trade status: not trade banned.

Related SteamRep Cases:
------------------------------
http://forums.steamrep.com/threads/76561197998828799-hatemyswag.26294/
http://forums.steamrep.com/threads/76561197979425414-niccito.26032/
http://forums.steamrep.com/threads/76561197979425414-niccito.26030/
http://steamrep.com/profiles/76561198066034899 - large number of further alts

The hijacker also tried to log onto my alt email but was denied. Here's his ip and location (Probably)

http://postimg.org/image/s06nctczb/

Thanks for the update, and to the admins for looking over this report. My account has now been restored to me by Support. However, the account that received many of my items, #onelove (STEAM_0:1:19281535) has still not been trade banned despite being marked on SteamRep. Let's hope Steam support can catch up with this person and their many alts.

Is there anything to be done about the items that were sold by the hijacker? I've had them restored at my end, but the ones sold prior to this are still out there.

My account, now reinstalled, is functioning normally so far. However, it seems this is also true of the scammer's accounts. I hope SteamRep/Steam can worth together to take some action against these at some point so fewer people need to go through the inconvenience I did.

Update on scammer niccito (STEAM_0:0:9579843): Strangely, the trade status of one of this scammer account has actually been reduced from ban to probation despite some pretty blatant activity (see below). As a result, they have been logging in and trading again regularly, liquidating items and gaining keys. Steam Profile showing trade status: before and after (< today). Backpack: before and after (< today). It doesn't seem the account was restored to a rightful owner (if there is one) as the profile text is still the scammer's.

Evidence of niccito's actvity:

a) See thread above - profile identical to other scammer profiles
b) niccito trades from one marked scammer, pedro_13 (STEAM_0:1:26767546), to another, #lifefor (STEAM_0:1:51069860): screenshot. More trades in BP history.
c) the two marked scammers remain in the friends list of niccito, which only has 4 members total (< screenshot). I'm assuming pedro's account was hijacked, but either way, pedro's a marked scammer and niccito has traded many items from them.
d) Further examples of items traded from marked scammer: buds, key, many more in BP

Update on other scammer alts: none of the previously identified scammers: #lifefor (STEAM_0:1:51069860), #deepinwhile (STEAM_0:1:63659995), or #onelove (STEAM_0:1:19281535) have been trade banned. Lifefor was identified as a scammer even before becoming involved with my items, with some alts showing activity going back at least to last year.

Oh, and, thanks for existing, SteamRep and admins

I sincerely apologize for the late reply, we are extremely backed up in this section.

The appropriate accounts have been marked for phishing for a while before my post, so I'm late with that. I am going to dig for more alts and see what I can do.

I can't mark the hijacker for hijacking you for these reason:

1. You aren't logged into the forums with a steam account.
2. You didn't post steam support screenshots.
3. You didn't post inventory history screenshots.

If you feel like giving me those pieces of evidence, PM me. Otherwise, I am closing this due to the age.
Thanks.