Compromised PoE Accounts: Stolen Items and Hacked Accounts - Discussion and Leads

Don't use 3rd party app
Don't click on any links sent in game
Don't RMT

It's that simple

I can guarantee 90% of accounts stolen were using RMT websites, always was the case and always will

I can guarantee that you are wrong and your ragebait attempt is pretty disgusting for anyone that lost a lot.

I've never used RMT websites or clicked on their links. I'm 100% sure. So your argument is pretty much invalid.

Also got hacked last night, 0 notifications, hacker bypassed the steam auth....

used Exiled Exchange for the past 7 days, yesterday got a lucky drop and searched the item with the trade macro ( was smth like 80 div ), maybe is somehow related.


All the gear is gone

"

nfb04#2789 wrote:

@Yoinkz#6468 - did you list the mirror on trade, or via exchange? i also got hacked the day i had a mirror on trade. were there any strange trade attempts before? i had one guy just letting me put the mirror in the trade window and then he cancelled and left, and another guy who wanted me to enter his hideout and he then put in exalts instead of divines.
probably not related but maybe theres a similarity?
i finally sold it via exchange, so i never had any other valuable items listed on trade (however i bought some expensive items)

Same for me. Just listed my 2 mirrors on trade. Have some strange offers, even RMT included and today all my gear, mirrors and divines got stollen.

"

WTFACTUALLYRESPONDS#0862 wrote:

"

victornunezrivero#1974 wrote:

A "cookies hack" is one possible way your Steam account could have been compromised. This technique exploits session cookies, which are used to keep users logged in after they authenticate. If an attacker obtains a valid session cookie, they can potentially bypass two-factor authentication (2FA) and other security measures.

ah yes, this would explain all the ppl using standalone only that got hacked, makes sense now ty

I'm playing on steam and all my items got stollen

This looks pretty much like a targeted attack then. I guess those hackers are looking for accounts with high value items on trade and then somehow can login without triggering any 2FA auth/email. There are currently only 8 mirrors on trade and we already have 3 people here that got hacked after having trade listed one.

Also, interesting thing regarding my account after being hacked:

- I always play through the Steam client, but I have the option to log in with email and password to start a league when Steam might be delayed.
- After the hack, I tried to log into the account using email and password and, to my surprise, the password did not work.

I have no notifications about password changes. My email has two-factor authentication, as does Steam.

It's possible, of course, that I simply forgot the old password, but if that's not the case, then I'm very curious as to how the thieves were able to change it. There are no new connections in the Steam history. There is no connection history in the POE account, so I can't find out if they visited the site.

Also, there I'm 100% sure that my old password wasn't compromised.

I think they might have gotten the session id when they tried to trade with me and used it to change the password on the site and log into the client.

Some threads from reddit about the situation:

https://www.reddit.com/r/pathofexile/comments/1hou6wg/my_friend_was_hacked_today/

https://www.reddit.com/r/pathofexile/comments/1ho06ui/logged_in_this_afternoon_to_a_naked_character_and/

https://www.reddit.com/r/PathOfExile2/comments/1hohy4h/its_just_gone_everything/

and youtube:

[PoE2] My Account got HACKED and So Did Many Others
https://www.youtube.com/watch?v=xDmLQL7JhMc

HUGE ONGOING HACK WAVE IN POE 2!! | This Is How YOU CAN BE Hacked!!
https://www.youtube.com/watch?v=WtGqcTVujCI

People on Steam write in discussions and reviews about it too. So this is getting pretty widespread.