Click Adventure - Revision history

AnotherConsumerRightsPerson: AnotherConsumerRightsPerson moved page Click Adventure Scam Game: Draining Consumer Wallets and Bypassing Steam Security to Click Adventure

2026-04-13T19:08:25Z

AnotherConsumerRightsPerson moved page Click Adventure Scam Game: Draining Consumer Wallets and Bypassing Steam Security to Click Adventure

← Older revision		Revision as of 19:08, 13 April 2026
(No difference)

Louis: gutted the ai slop, sourced everything to the sentinels investigation report. fixed wrong removal date (was sep 15, actually sep 12), removed unsourced security concerns and recommendations sections, removed malware speculation (accounts were pre-compromised not hacked through the game). title still needs a rename

2026-03-29T02:33:14Z

gutted the ai slop, sourced everything to the sentinels investigation report. fixed wrong removal date (was sep 15, actually sep 12), removed unsourced security concerns and recommendations sections, removed malware speculation (accounts were pre-compromised not hacked through the game). title still needs a rename

Show changes

Keith: Removed the conclusion, but in general this article is very AI-y and under-sourced

2026-03-25T18:46:03Z

Removed the conclusion, but in general this article is very AI-y and under-sourced

← Older revision		Revision as of 18:46, 25 March 2026
Line 1:		Line 1:
	{{Incomplete\|Issue 1=needs more references}}{{IncidentCargo		{{Incomplete\|Issue 1=needs more references}}
			{{IncidentCargo
	\|Company=Valve		\|Company=Valve
	\|StartDate=2025-08-06		\|StartDate=2025-08-06
Line 61:		Line 62:
	*Report suspicious games via Steam discussions and contact support immediately upon detecting unauthorized activity.		*Report suspicious games via Steam discussions and contact support immediately upon detecting unauthorized activity.
	*Deauthorize all devices and change passwords if compromise is suspected.		*Deauthorize all devices and change passwords if compromise is suspected.

	~~==Conclusion==~~
	The ''Click Adventure'' case underscores possible vulnerabilities in Steam's systems that enabled malicious actors to drain funds from users without triggering standard security alerts. While Valve has taken steps (removing the game), many affected users have not received recompense. Whether this incident prompts broader policy or security changes remains to be seen.

	==References==		==References==

Tempo123: Switch citation 1 to Nitter link and archive

2026-03-20T14:21:30Z

Switch citation 1 to Nitter link and archive

← Older revision		Revision as of 14:21, 20 March 2026
Line 25:		Line 25:
	#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.		#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.

	This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|author=Mellow_Online1 \|date=2025-09-16 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://~~xcancel~~.~~com~~/MellowOnline1/status/1968086263027671287 \|url-status=live \|website=Twitter}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.		This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|author=Mellow_Online1 \|date=2025-09-16 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://nitter.net/MellowOnline1/status/1968086263027671287 \|url-status=live \|archive-url=https://ghostarchive.org/archive/4a6P3 \|archive-date=20 Mar 2026 \|website=Twitter}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.

	==Bypass of Steam Guard security==		==Bypass of Steam Guard security==

Rudxain: wanted: cookies

2026-03-15T14:43:00Z

wanted: cookies

← Older revision		Revision as of 14:43, 15 March 2026
Line 30:		Line 30:
	[https://help.steampowered.com/en/faqs/view/06B0-26E6-2CF8-254C Steam Guard], Valve's two-factor authentication system, typically sends alerts for unrecognized logins to protect accounts. However, in these incidents, no such alerts were received, allowing unauthorized access and transactions. Reports suggest the compromise occurred via session hijacking or credential theft, possibly facilitated by malicious code within the game itself. The consistent targeting of ''Click Adventure'' inventory items implies the exploit was designed to launder funds through Marketplace purchases, evading detection.		[https://help.steampowered.com/en/faqs/view/06B0-26E6-2CF8-254C Steam Guard], Valve's two-factor authentication system, typically sends alerts for unrecognized logins to protect accounts. However, in these incidents, no such alerts were received, allowing unauthorized access and transactions. Reports suggest the compromise occurred via session hijacking or credential theft, possibly facilitated by malicious code within the game itself. The consistent targeting of ''Click Adventure'' inventory items implies the exploit was designed to launder funds through Marketplace purchases, evading detection.

	The game's low-effort design—a simple clicker uncovering locations and loot—may have served as a vector for malware, extracting session cookies or login data without user awareness. This allowed hackers to maintain persistent access without re-authentication, directly draining wallets for in-game asset buys.		The game's low-effort design—a simple clicker uncovering locations and loot—may have served as a vector for malware, extracting session [[Web cookie\|cookies]] or login data without user awareness. This allowed hackers to maintain persistent access without re-authentication, directly draining wallets for in-game asset buys.

	==Developer and publisher analysis==		==Developer and publisher analysis==

Atrocious: /* References */ Replaced Twitter link with privacy frontend link

2026-03-01T14:41:27Z

References: Replaced Twitter link with privacy frontend link

← Older revision		Revision as of 14:41, 1 March 2026
Line 25:		Line 25:
	#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.		#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.

	This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|author=Mellow_Online1 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://x.com/MellowOnline1/status/1968086263027671287}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.		This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|author=Mellow_Online1 \|date=2025-09-16 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://xcancel.com/MellowOnline1/status/1968086263027671287 \|url-status=live \|website=Twitter}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.

	==Bypass of Steam Guard security==		==Bypass of Steam Guard security==

Banana: Added archive URLs for 2 citation(s) using CRWCitationBot

2026-02-16T02:22:52Z

Added archive URLs for 2 citation(s) using CRWCitationBot

← Older revision		Revision as of 02:22, 16 February 2026
Line 33:		Line 33:

	==Developer and publisher analysis==		==Developer and publisher analysis==
	The game was developed and published by "Folso Dev.," an entity with no prior Steam history beyond ''Click Adventure''. The name "Folso Dev." raises suspicions, phonetically resembling "false dev," and no verifiable social media, support contacts, or external presence exists for the developer outside automated Steam crawls. The game's [https://steamdb.info/app/3874190/ SteamDB page] shows it achieved a peak of only 4 concurrent players before removal on or around September 15, 2025, further indicating it was not a legitimate commercial release but potentially a vehicle for scams. The earliest wallet-drain reports appeared after the initial release, but before the build pushed on September 12, 2025, just before the game was banned.<ref>{{Cite web \|author=Sentinels of the Store \|title=Click Adventure: How a Banned Steam Game Drained Wallets and Dodged Steam Security \|url=https://steamcommunity.com/groups/Sentinels_of_the_Store/announcements/detail/534361794856092966}}</ref>		The game was developed and published by "Folso Dev.," an entity with no prior Steam history beyond ''Click Adventure''. The name "Folso Dev." raises suspicions, phonetically resembling "false dev," and no verifiable social media, support contacts, or external presence exists for the developer outside automated Steam crawls. The game's [https://steamdb.info/app/3874190/ SteamDB page] shows it achieved a peak of only 4 concurrent players before removal on or around September 15, 2025, further indicating it was not a legitimate commercial release but potentially a vehicle for scams. The earliest wallet-drain reports appeared after the initial release, but before the build pushed on September 12, 2025, just before the game was banned.<ref>{{Cite web \|author=Sentinels of the Store \|title=Click Adventure: How a Banned Steam Game Drained Wallets and Dodged Steam Security \|url=https://steamcommunity.com/groups/Sentinels_of_the_Store/announcements/detail/534361794856092966 \|url-status=live \|archive-url=http://web.archive.org/web/20260111120725/https://steamcommunity.com/groups/Sentinels_of_the_Store/announcements/detail/534361794856092966 \|archive-date=11 Jan 2026}}</ref>

	Steam's Terms of Service require developers to maintain accurate contact information and adhere to security standards. Valve's review process failed to detect the exploit prior to launch, allowing the game to go live for over a month.		Steam's Terms of Service require developers to maintain accurate contact information and adhere to security standards. Valve's review process failed to detect the exploit prior to launch, allowing the game to go live for over a month.

	==Valve's response==		==Valve's response==
	Valve removed ''Click Adventure'' from the Steam store following user reports, but affected users have not received refunds or compensation. One forum claim suggests some refunds occurred, but no verified cases have been confirmed, and multiple victims report Valve denying reimbursement requests. Steam's Subscriber Agreement states that users are responsible for securing their accounts, potentially shielding Valve from liability:<blockquote>You are responsible for maintaining the confidentiality of your account and password and for restricting access to your computer. You agree to accept responsibility for all activities that occur under your account or password.<ref>{{Cite web \|author=Valve \|title=Valve's response \|url=https://imgur.com/a/zzFSHgU}}</ref></blockquote>This clause may justify Valve's refusal, despite the compromise originating from a Valve-vetted game. No broader investigation into similar exploits across other titles has been announced.		Valve removed ''Click Adventure'' from the Steam store following user reports, but affected users have not received refunds or compensation. One forum claim suggests some refunds occurred, but no verified cases have been confirmed, and multiple victims report Valve denying reimbursement requests. Steam's Subscriber Agreement states that users are responsible for securing their accounts, potentially shielding Valve from liability:<blockquote>You are responsible for maintaining the confidentiality of your account and password and for restricting access to your computer. You agree to accept responsibility for all activities that occur under your account or password.<ref>{{Cite web \|author=Valve \|title=Valve's response \|url=https://imgur.com/a/zzFSHgU \|url-status=live \|archive-url=http://web.archive.org/web/20250922113522/https://imgur.com/a/zzFSHgU \|archive-date=22 Sep 2025}}</ref></blockquote>This clause may justify Valve's refusal, despite the compromise originating from a Valve-vetted game. No broader investigation into similar exploits across other titles has been announced.

	==Security Concerns==		==Security Concerns==

Bythmusters: Added cargo details

2025-12-04T21:39:56Z

Added cargo details

← Older revision		Revision as of 21:39, 4 December 2025
Line 1:		Line 1:
	{{Incomplete\|Issue 1=needs more references}}		{{Incomplete\|Issue 1=needs more references}}{{IncidentCargo
	{{IncidentCargo
	\|Company=Valve		\|Company=Valve
	\|Status=~~Active~~		\|StartDate=2025-08-06
			\|EndDate=2025-09-15<!--approximate date game was removed from steam as per article-->
			\|Status=Resolved<!--I marked resolved because Valve has already responded, and is unlikely to do anything else-->
	\|ProductLine=Steam		\|ProductLine=Steam
	\|ArticleType=~~Service~~		\|Product=Steam
			\|ArticleType=Incident
	\|Type=Scam, Security		\|Type=Scam, Security
	\|Description=The ~~Click Adventure controversy involves the~~ Steam game Click Adventure ~~compromising~~ users' accounts ~~to execute~~ unauthorized transactions.		\|Description=The Steam game 'Click Adventure' compromised users' accounts and executed unauthorized Steam Marketplace transactions.
	}}In mid-2025, a game named ''Click Adventure'', published by “Folso Dev.” on Steam, was found to have facilitated unauthorized withdrawals from users’ [https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59 Steam Wallets] via the Steam Community Marketplace. Players reported wallet funds disappearing after transactions of worthless items, despite having security features enabled. The game was eventually removed from Steam, but many victims have not received refunds. This case has raised concerns about gaps in Steam’s marketplace and account security. Steam, in response, has responded saying that Community Mark transactions are not possible to reverse despite the developer having already been banned from the platform by the time the refunds were sought.		}}
			In mid-2025, a game named ''Click Adventure'', published by “Folso Dev.” on Steam, was found to have facilitated unauthorized withdrawals from users’ [https://help.steampowered.com/en/faqs/view/78E3-7431-1E88-AD59 Steam Wallets] via the Steam Community Marketplace. Players reported wallet funds disappearing after transactions of worthless items, despite having security features enabled. The game was eventually removed from Steam, but many victims have not received refunds. This case has raised concerns about gaps in Steam’s marketplace and account security. Steam, in response, has responded saying that Community Mark transactions are not possible to reverse despite the developer having already been banned from the platform by the time the refunds were sought.

	==Background==		==Background==

2A00:23C8:2384:101:B34:3E7B:6AF4:18CF: fixed cite errors

2025-11-06T22:48:12Z

fixed cite errors

← Older revision		Revision as of 22:48, 6 November 2025
Line 22:		Line 22:
	#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.		#'''Wallet Drainage''': The scammer then used the compromised "buyer" accounts to purchase these overpriced shell items. This transaction effectively transferred the funds from the victims' wallets to the scammer's "seller" accounts.

	This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|~~first~~=Mellow_Online1 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://x.com/MellowOnline1/status/1968086263027671287}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.		This process was repeated across numerous compromised accounts, allowing the scammer to quickly and efficiently launder stolen funds. At least 18 users worldwide have publicly reported these issues<ref>{{Cite web \|author=Mellow_Online1 \|title=At least 18 users across the world report that their Steam Wallets have been drained \|url=https://x.com/MellowOnline1/status/1968086263027671287}}</ref>, with discussions indicating up to 25 cases, though the true number may be higher as not all victims come forward. Users described their accounts as compromised, with wallet funds vanishing through purchases of Click Adventure-specific items, despite no prior engagement with the game.

	==Bypass of Steam Guard security==		==Bypass of Steam Guard security==
Line 30:		Line 30:

	==Developer and publisher analysis==		==Developer and publisher analysis==
	The game was developed and published by "Folso Dev.," an entity with no prior Steam history beyond ''Click Adventure''. The name "Folso Dev." raises suspicions, phonetically resembling "false dev," and no verifiable social media, support contacts, or external presence exists for the developer outside automated Steam crawls. The game's [https://steamdb.info/app/3874190/ SteamDB page] shows it achieved a peak of only 4 concurrent players before removal on or around September 15, 2025, further indicating it was not a legitimate commercial release but potentially a vehicle for scams. The earliest wallet-drain reports appeared after the initial release, but before the build pushed on September 12, 2025, just before the game was banned.<ref>{{Cite web \|~~first~~=Sentinels of the Store \|title=Click Adventure: How a Banned Steam Game Drained Wallets and Dodged Steam Security \|url=https://steamcommunity.com/groups/Sentinels_of_the_Store/announcements/detail/534361794856092966}}</ref>		The game was developed and published by "Folso Dev.," an entity with no prior Steam history beyond ''Click Adventure''. The name "Folso Dev." raises suspicions, phonetically resembling "false dev," and no verifiable social media, support contacts, or external presence exists for the developer outside automated Steam crawls. The game's [https://steamdb.info/app/3874190/ SteamDB page] shows it achieved a peak of only 4 concurrent players before removal on or around September 15, 2025, further indicating it was not a legitimate commercial release but potentially a vehicle for scams. The earliest wallet-drain reports appeared after the initial release, but before the build pushed on September 12, 2025, just before the game was banned.<ref>{{Cite web \|author=Sentinels of the Store \|title=Click Adventure: How a Banned Steam Game Drained Wallets and Dodged Steam Security \|url=https://steamcommunity.com/groups/Sentinels_of_the_Store/announcements/detail/534361794856092966}}</ref>

	Steam's Terms of Service require developers to maintain accurate contact information and adhere to security standards. Valve's review process failed to detect the exploit prior to launch, allowing the game to go live for over a month.		Steam's Terms of Service require developers to maintain accurate contact information and adhere to security standards. Valve's review process failed to detect the exploit prior to launch, allowing the game to go live for over a month.

	==Valve's response==		==Valve's response==
	Valve removed ''Click Adventure'' from the Steam store following user reports, but affected users have not received refunds or compensation. One forum claim suggests some refunds occurred, but no verified cases have been confirmed, and multiple victims report Valve denying reimbursement requests. Steam's Subscriber Agreement states that users are responsible for securing their accounts, potentially shielding Valve from liability:<blockquote>You are responsible for maintaining the confidentiality of your account and password and for restricting access to your computer. You agree to accept responsibility for all activities that occur under your account or password.<ref>{{Cite web \|~~first~~=Valve \|title=Valve's response \|url=https://imgur.com/a/zzFSHgU}}</ref></blockquote>This clause may justify Valve's refusal, despite the compromise originating from a Valve-vetted game. No broader investigation into similar exploits across other titles has been announced.		Valve removed ''Click Adventure'' from the Steam store following user reports, but affected users have not received refunds or compensation. One forum claim suggests some refunds occurred, but no verified cases have been confirmed, and multiple victims report Valve denying reimbursement requests. Steam's Subscriber Agreement states that users are responsible for securing their accounts, potentially shielding Valve from liability:<blockquote>You are responsible for maintaining the confidentiality of your account and password and for restricting access to your computer. You agree to accept responsibility for all activities that occur under your account or password.<ref>{{Cite web \|author=Valve \|title=Valve's response \|url=https://imgur.com/a/zzFSHgU}}</ref></blockquote>This clause may justify Valve's refusal, despite the compromise originating from a Valve-vetted game. No broader investigation into similar exploits across other titles has been announced.

	==Security Concerns==		==Security Concerns==

Mr Pollo at 20:42, 19 September 2025

2025-09-19T20:42:28Z

← Older revision		Revision as of 20:42, 19 September 2025
Line 1:		Line 1:
			{{Incomplete\|Issue 1=needs more references}}
	{{IncidentCargo		{{IncidentCargo
	\|Company=Valve		\|Company=Valve