Yesterday, while I was playing, I got logged out of Steam. When I logged back in, I noticed that the game Rust had been running for 4 minutes. I haven’t launched this game in years, and it isn’t even installed on my PC. Somehow, someone accessed my account and started this game.

I checked my authorized devices on Steam — all my devices are visible, and there are no unknown devices. I also looked at my account sessions and noticed some strange logins. This has never happened before, and I double-checked my session history.

Some additional context:

• I do not have the Steam API enabled.
  
  
• I have two-factor authentication enabled.
  
  
• I received no login notifications.
  
  
• Some of these sessions occurred on days when my computer was completely off.
  
  
• I received no login notifications or alerts about these sessions.

I already logged out from all devices and changed all my passwords. Yet, the same thing happened again last night — someone is still accessing my account.

The only unusual thing I did was use a piece of software a week ago to access Battlefield 6 in my country:
https://github.com/xModern54/zapret-bf

That’s the only thing I can think of that might have caused this. Since there are no unauthorized devices listed, it looks like some kind of authentication tokens were stolen, though enough time should have passed for them to expire.

On top of that, I’ve received emails from noreply@steampowered.com
about points being deducted to other profiles. No points were actually lost, but the messages are real Steam emails.

I really don’t understand what is happening. Has anyone experienced something similar? Could my account still be compromised? And how its possible?