Over the past few weeks, I have been friended on several occasions by Chinese Steam accounts; they stay dormant for a while, usually just a few days, which is clearly long enough for me to forget about them. This is by design, as I will explain further on.
The accounts themselves, on the other hand, usually follow a similar design in terms of their profile picture and naming: usually a female name as the username, and the profile picture being a picture of an Asian model in a seductive pose, with the site’s URL clearly visible in the image.
Essentially, this is a hookup scam, not so dissimilar to those you would find on those business cards of sorts you would see all over Al Barsha in Dubai. But this time it has gone digital, and on Steam of all places.
When the account adds you on Steam, as previously stated will typically wait a few days before sending you a single message in Steam’s chat feature, which just includes an image with the same two URLs as in the profile picture, but this time it has a bit more detail in terms of what they are saying you will find on the site.
From what I have investigated, once you type the website into your phone’s browser, it directs you to a sketchy solicitation website that tries to install an APK of some kind onto your phone, most likely to try to gain access to your Steam account, or possibly into other apps such as banking, etc.
When viewed on urlscan.io, it shows that the domain itself seems to be a redirect chain, which means that it is very hard to take the actual site down, as it hides behind the initial domain.
When scanned and/or viewed from a desktop, the user gets nothing besides a blocked page; the actual scam itself seems to be targeting users specifically using phone browsers.
The accounts used in this scam seem to only be targeting Chinese accounts on Steam, usually those with Chinese names or in Chinese language/locale steam groups.
And the reason the operators of this scam seem to be targeting Steam users is that Steam accounts are free to create, with little to no verification, such as phone number requirements, etc., unlike other social media sites such as Facebook have implemented them as deterrents for things such as this.
As well as this, it is also due to the fact that Steam has free image hosting and a large Chinese user base, with very lax moderation in comparison to other websites.
This all seems to be a digital evolution from the original and well-documented scam that plagued Dubai in the early 2000s, where you would find raunchy massage parlor cards placed in windscreens and the like, across neighbourhoods such as Al Barsha and Deira.
But instead of being ambushed in an unlicensed apartment and robbed of your wallet, you are instead robbed of your Steam account or banking information, all in the comfort of your living room. But the overall formula remains the same: the same-looking cards and wording, albeit now hosted on Steam’s CDN instead of a car window in the early hours of the morning.
