Help and Information - Compromised PoE Accounts: Stolen Items and Hacked Accounts - Discussion and Leads - Forum

i can garantee i havent used any rmt or any weird link ... only possible thing for me was loggin in on Overwolf PoE2 Overlay, but still many of my friends and other ppl did too and werent hacked, been playing this game for 11 years now and this is the only time it happened	Posted by Crainus#7059 on Dec 29, 2024, 9:16:24 AM Quote this Post
" CTMB_Nara#0471 wrote: Also, interesting thing regarding my account after being hacked: - I always play through the Steam client, but I have the option to log in with email and password to start a league when Steam might be delayed. - After the hack, I tried to log into the account using email and password and, to my surprise, the password did not work. I have no notifications about password changes. My email has two-factor authentication, as does Steam. It's possible, of course, that I simply forgot the old password, but if that's not the case, then I'm very curious as to how the thieves were able to change it. There are no new connections in the Steam history. There is no connection history in the POE account, so I can't find out if they visited the site. Also, there I'm 100% sure that my old password wasn't compromised. I think they might have gotten the session id when they tried to trade with me and used it to change the password on the site and log into the client. so far only one other guy reported having email / password changed through the PoE website, could you please check if thats the case ? if i do recall its in the account management section	Posted by Crainus#7059 on Dec 29, 2024, 9:19:38 AM Quote this Post
After reading the whole topic I think people are actually getting targeted , people with high value stuff , mirrors, high value gear etc. . It actually seems to be a problem and I`d wish GGG would clarify or have a statement about this.	Posted by itubogdan#4424 on Dec 29, 2024, 9:28:37 AM Quote this Post
have to wait until the higher people (Jonathan) return from their holidays. Can't get any proper explanation otherwise it seems.	Posted by waitingforunlock#4272 on Dec 29, 2024, 9:31:35 AM Quote this Post
" Dkodr#6088 wrote: Can those who got compromized verify if they used a unique secure password for their poe account? Something they never used anywhere else and hard to guess, at least 8 characters long. There is an argument made that the reason ppl get hacked is the use of a weak passwords that are included in so called dictionary attacks. One can also check if the email used has been compromized her: https://haveibeenpwned.com/ It can give an indicator of whether it was used as an entry point or not. Passwords can also be checked here: https://haveibeenpwned.com/Passwords @Dkodr#6088 sure, my e-mail was "there" but my password was not there, not any of my "old" passwords were there. (updated em all once i was hacked here). looking more and more like GGG leak or cookie grab	Posted by Thuse#4258 on Dec 29, 2024, 9:40:59 AM Quote this Post
So far looks like people with high value items or with alot of currency getting targeted. Also looks like it doesnt matter if you have extensions or not. Doesnt matter if you log through steam or standalone. Doesnt matter if you get new location mail or not. Am 99% sure its on ggg part. Am back!	Posted by rngaddicted#7405 on Dec 29, 2024, 9:45:10 AM Quote this Post
Bump, as a cybersecurity specialist i fear RCE in all of this if the launcher is involved (or the antichat the kernel level, lovely) i did not look into it as i cannot without authorization. (proprietary closed source) but ill just go straight to valve, feelslike you can just do anything with this vulnerability.	Posted by Rosky#1061 on Dec 29, 2024, 12:32:12 PM Quote this Post
" Rosky#1061 wrote: Bump, as a cybersecurity specialist i fear RCE in all of this if the launcher is involved (or the antichat the kernel level, lovely) i did not look into it as i cannot without authorization. (proprietary closed source) but ill just go straight to valve, feelslike you can just do anything with this vulnerability. I dont know much about cybersecurity but RCE probably explains why a lot of ppl got random friend requests/invites and random ppl visited their HO before they got hacked, one of the randoms was the guy whose name ends on ood_, who was reported for selling stolen stuff. Am back! Last edited by rngaddicted#7405 on Dec 29, 2024, 12:47:21 PM	Posted by rngaddicted#7405 on Dec 29, 2024, 12:45:47 PM Quote this Post
" rngaddicted#7405 wrote: " Rosky#1061 wrote: Bump, as a cybersecurity specialist i fear RCE in all of this if the launcher is involved (or the antichat the kernel level, lovely) i did not look into it as i cannot without authorization. (proprietary closed source) but ill just go straight to valve, feelslike you can just do anything with this vulnerability. I dont know much about cybersecurity but RCE probably explains why a lot of ppl got random friend requests/invites and random ppl visited their HO before they got hacked, one of the randoms was the guy whose name ends on ood_, who was reported for selling stolen stuff. You don't need RCE for that. Just looking at the trade website will give you an account name (directly shown) and a character name ("copy whisper" then ctrl+v in game). That charname is all you need to send a friend request, and if you click and accept the request (for example if you're inside a map and wanna get rid of the popup quickly, or they send you the whisper for buying one of your items and send a friend invite, which you mistake as a party invite, there's many ways to dupe people...) then by default they can join your hideout. Personally I'm thinking more along the line of we got a big change in the way account works a few weeks back and things didn't go smoothly during the transition, so maybe someone decided to poke in there and found something. But that's just my 2 cents and one of the many ways this could have happened.	Posted by Amarantha#5160 on Dec 29, 2024, 12:56:56 PM Quote this Post
" itubogdan#4424 wrote: After reading the whole topic I think people are actually getting targeted , people with high value stuff , mirrors, high value gear etc. . It actually seems to be a problem and I`d wish GGG would clarify or have a statement about this. I lost like 12 exhalts some vals a chance nothing big so I dont know about that one sadly	Posted by karnaij#7052 on Dec 29, 2024, 1:05:15 PM Quote this Post