This phish starts out with a friend invite. After you accept the invite you get asked to play in a TF2 tournament.

After clicking “Join the game!”, “Sign In”, or any other links you might see you will get prompt to log in using Steam.

The login page does not say steamcommunity.com so it is easy to spot. Never login on websites that do not show steamcommunity.com address.

How to avoid this phish?

Always check that the address starts with https://steamcommunity.com and just to be safe you can type that yourself to avoid look a likes with different symbols that may look like the real letter but aren’t, for example i is not ı and so on.

Another simple trick is to login at https://steamcommunity.com first, then if you are feeling brave enough open possible suspicious link(s) and see if you are logged in or not. If you are automatically logged to Steam then it’s very likely the real Steam openID portal.