Back to Fake Game Item Vote Login Scam Phishing

This is a version of Fake Game Item Vote Login Scam in Phishing.

Fake Steam Workshop page asking you to vote for a Counter-Strike 2 skin that opens its own login window

A page copies the Steam Workshop page for a fan-made Counter-Strike 2 weapon skin, "AWP | Ancient Heritage", with the Steam logo and menus, item pictures, award icons, a visitor counter and the question "Would you like to see this item officially accepted and supported in Counter-Strike 2?" with a Yes button. The description ends with "Don't forget to Vote and Favorite". The page title spells Steam with look-alike letters, and the page code opens its own login window when certain buttons are clicked. It was last seen in Sweden on November 1, 2026, at store.communityartsections[.]com, a domain registered three days earlier. The same page code was seen in El Salvador on October 15, 2026, at store.communitydevelopers[.]shop, and was first observed on August 3, 2026, at store.poweredappsource[.]shop with a different skin. None of these addresses belong to Steam or Valve.

Fake Steam Workshop page asking you to vote for a Counter-Strike 2 skin that opens its own login window | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. The page title reads "Stеаm Workshop", where the "е" and "а" are Cyrillic letters that look like the Latin ones. This can slip past filters that look for the word Steam.

  2. The page code listens for clicks on buttons marked as login buttons, stops the normal link from opening and loads a separate login window inside the page. The Research Inbox analysis found a password field on the page. The real Steam sign-in page is never shown.

  3. The addresses are "store." subdomains on names that sound like developer or community sites: store.poweredappsource[.]shop, store.communitydevelopers[.]shop and store.communityartsections[.]com. The last one was registered three days before it was captured.

  4. All three addresses share the same page code. The skin was "Brassbound Fury" on August 3, 2026, and "AWP | Ancient Heritage" on October 15 and November 1, 2026, so the kit is reused with new items.

  5. Sightings were in El Salvador (two on October 15, 2026) and Sweden (November 1, 2026). The location of the August sighting was not recorded.

  6. The login window itself and what it asks for were not captured, and how the link reached the people who found it was not recorded.

Related scams

Other patterns in the same category, or that share a brand with this report.

How this scam works

  1. 1

    Step 1: A message, post or chat gives you a link to a game item, such as a weapon skin, and asks you to vote for it or add it to your favorites.

  2. 2

    Step 2: The page copies the gaming platform's community page, with its logo, menus, item pictures, vote buttons and visitor counts, but the web address belongs to someone else.

  3. 3

    Step 3: When you click to vote, favorite or log in, the page opens its own sign-in window inside the page instead of sending you to the platform's real sign-in page.

  4. 4

    Step 4: Your username, password and any login code go to the people behind the page. They can sign in to your account, take your items and may use the account to send the same link to your friends.

✓ Do this

  • Sign in only through the platform's official app or by typing its web address yourself.
  • Check the full web address before you sign in, and close any page that is not on the platform's real address.
  • Turn on the platform's own two-step sign-in, such as its mobile authenticator.
  • If you typed your password into a page like this, change it from the official app, sign out all other devices and check your account's trade and security settings.
  • Warn the friend who sent you the link, since their account may have been taken over.

✗ Avoid this

  • Do not sign in from a link that asks you to vote for or favorite a game item.
  • Do not trust a sign-in window because it shows the platform's logo or what looks like an address bar, since it can be drawn inside the page.
  • Do not share login codes or approve sign-in requests you did not start.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    Stеаm Workshop::AWP | Ancient Heritage
  2. 2 Excerpt 2
    Would you like to see this item officially accepted and supported in Counter-Strike 2?
  3. 3 Excerpt 3
    Yes
  4. 4 Excerpt 4
    I will be grateful for any support from your side, I plan to make ak in the same style, wait for updates;)
  5. 5 Excerpt 5
    Don't forget to Vote and Favorite, Thank You <3
  6. 6 Excerpt 6
    1,353 Unique Visitors
  7. 7 Excerpt 7
    You need to sign in or create an account to do that.