xQc, Cooper hit by new CS:GO console exploit on stream

During a CS:GO case unboxing stream by former Overwatch pro and variety streamer Félix "xQc" Lengyel, his console was forced open to display a message with the text "uh oh" that included a link to a Discord server. This raises enormous security questions as it could mean an attacker had access to his console. He did not join a community server beforehand, which likely means that an outside entity had access to send that message through his console.

It can also be seen in the clip that a line that includes "P2P" flashes, which likely suggests that this malicious attack was perpetrated in a peer to peer manner, which means the attacker either has xQc's IP address somehow or is using an exploit in Steam to relay P2P traffic to him via Steam servers. In that same line are two empty steam64ids, which are likely the accounts that the exploit is being run from.

Austin "Cooper" Abadir, a streamer and player for Mythic, also reported a similar incident happening to him. Michael ‘Swisher’ Schmid tweeted that Tyler "tweiss" Weiss was also affected by the same exploit, which solidifies the argument that this exploit is inherent to Steam and is not simply due to a folly on xQc's behalf. Talking with Dust2.us, Cooper added that he has forwarded his experience to the CS:GO devs.

Cooper additionally says that the perpetrator of his attack was seeking an advertisement for his YouTube channel. Without revealing the culprit, it is a YouTuber who uploads videos of himself using exploits to troll streamers in various games such as CS:GO, Minecraft, and Agar.io to his impressive 1,000 subscribers. While xQc's attacker is yet unknown, it is possible that both were committed by the same actor. Responding to a question asking if the suspected individual was behind the xQc attack, he responded, "Possibly why?"

It is unknown at this time whether the same exploit used to attack xQc, Cooper, and tweiss can be used on other Steam users. It is also unknown whether the exploit allows any further malicious activity further than displaying a text message via the in-game console. Just this, however, is threatening, as unfettered access to the console is dangerously close to remote code execution.