This starts with two friend invites that look like this.

After one day both of those accounts get renamed to something else and either one or both of them sends you a message that looks something like this.

When you enter that link you get to a website mimicking to be Steam login with and shows your “gift”. This gift isn’t a Steam feature and Steam will never show you a page that looks like this.

How to avoid this phish?

Always check that the address starts with https://steamcommunity.com and just to be safe you can type that yourself to avoid look a likes with different symbols that may look like the real letter but aren’t, for example i is not ı and so on.

Another simple trick is to login at https://steamcommunity.com first, then if you are feeling brave enough open possible suspicious link(s) and see if you are logged in or not. If you are automatically logged to Steam then it’s very likely the real Steam openID portal.