New backdoor steam scam? (Need help with a scam ive never seen before on a friends account)
Apologies this is gonna be a wordy one, ive been on steam and in cs/tf2 trading for 10+ years so I know how these scammers can be, but wouldn't consider myself a tech wizard so my explanations wont be very concise.
For context:
My friend told me that a few days earlier he was invited to a counter strike lobby. In this lobby he was told that he needs to link his discord with faceit. Im not sure entirely what happened but from what i can gather the command prompt was used during this process. (My guess is that a trojan steam login page was involved as well)
Fast forward a day or 2 later, he is greeted with image 1 on his steam. Im assuming that the faceit discord linking process included malware, which i think would explain the command prompt being used. It blocks him from opening any games, using market, basically any feature in steam.
When clicking the contact steam support button it takes you to a chat window as seen in image 2. It asked for purchase receipts to start off with which steam normally do ask for i believe. (I worry that this is to gather information for a future social engineering scam if the initial scam doesnt work)
After inputting all the information it says "inventory isolation required" and then asks the user to trade all their cs items (no trading cards or items from other games so its clearly a scam). Luckily i intervened before my friend accepted the trade (images 3&4)
After doing some digging ive seen that pretty much the same scam has been used through wallpaper engine in the last 2 weeks. (This makes me think a new backdoor may have been used as both wallpaper engine and faceit both have admin access to both steam and windows)
In conclusion, i need help on how my friend can get rid of the malware that is stopping him from using his steam and am curious if this is something that has happened before or if it is something new.
Any help or thoughts are appreciated!