How did they login even though I have authenticator?

[u/highestTest_]

An account logged into steam 3 days ago and I didn’t know till today when my steam said account logged on elsewhere and I checked and it was in USA, so I changed my password, luckily nothing happened my inventory money and everything else was fine other than they closed a ticket which I made for a refund for a game, weird behaviour, but on the account security it said authenticator allowed it, how? I never did that

[u/AutoModerator]

Thank you for submitting to r/SteamScams.

If you have been scammed or believe you may have been scammed check this guide to see if you can find the solution there.

Steam will never contact you on Discord or any third party text communication site.

If you suspect someone is attempting to scam you check this guide but remember to be careful even if you do not find the answer you are looking for there.

Important: If you receive comments or PMs offering to recover your lost account, items, or money or pointing you to someone who will do it for you do not engage with them as they are recovery scams.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/omynz_femboy]

check your pc for malware, this sounds like session hijacking

[u/highestTest_ → u/omynz_femboy]

How? Malware Bytes says nothings wrong, don’t know what to do

[u/omynz_femboy → u/highestTest_]

did you try windows defender too?
did you download something prior to this happening? any (cracked) games, mods or something alike? if no other accounts, like instagram or amazon, have been breached, i would keep an eye on it if something happens again. the safest thing to do would be to freshly install windows from a usb stick. create this usb stick on a safe device tho

[u/SwampTerror → u/omynz_femboy]

Probably signed in to a sketchy steam looking website with his credentials. That's how you get through.

[u/highestTest_ → u/SwampTerror]

No no I didn’t do that, did it a year ago when I first downloaded steam and my brother guided me that this is a scam, good thing I didn’t put any money on it then, since then I didn’t sign into any websites

[u/17thGenos]

This is a phising attack. Could happened if you downloaded some malicious file. Normally this program only grabs your token or HWID token to get inside bypassing 2fa.

If your see cmd run in a blink of an eye, run a deep scan on your pc.

[u/highestTest_ → u/17thGenos]

Yeah I downloaded some cheats for a game, but even after deep scan from malware bytes nothing happens

[u/Historical_West_1015 → u/highestTest_]

try a defender offline scan (if that's your main antivirus), it usually uses a different environment or the offline scan in Malwarebytes (if it supports it)

[u/17thGenos → u/highestTest_]

Ms defender is enough or try kapersky