Fake Window, Real Loss: Browser-in-the-Browser Steam Phishing

A community manager reported losing access to their Steam account this afternoon, right after claiming what looked like a free Counter-Strike 2 case. Before you dig into the logs, get oriented on how this kind of attack works.

Start at the email gateway. Three messages reached Marko's mailbox that afternoon and the gateway logged what it made of each one. Work out which message is the lure, then recover the full sender address behind it.

Marko clicked the link. Before the page could load, the workstation had to turn that domain into an address. Use the proxy's DNS records to identify the host the giveaway site actually answers on.

The attacker did not build this page once. Recover the reused page title that would let you recognise the same template wherever else it is deployed.

Marko typed a Steam username and password into the fake pop-up. The URL bar in that window said one thing; the browser did another. Identify the domain that actually received the credentials.

Step back from the individual indicators and classify the deception itself. Marko was not beaten by a vulnerability and not by malware; he was beaten by a window that was not a window. Name the MITRE ATT&CK technique that covers what the attacker did to make that window work, at parent-technique level.