Secure your account:

1. Scan for malware.
https://www.malwarebytes.com/

2. Check that the email and phone number on the Steam account are still yours.

3. Deauthorize all other devices.
https://steamhost.cn/twofactor/manage

4. Change passwords from a clean computer.

5. Generate new backup codes for your Mobile App. https://steamhost.cn/twofactor/manage

6. Revoke the API key (there should be no key).
https://steamhost.cn/steamcommunity_com/dev/apikey

After you done all the steps here you should be safe.

引用自 flowery0：

I have already logged out everywhere on email and steam(though there weren't any suspicious sessions) and changed my steam password myself
I kind of doubt they'll succeed if they haven't done so yet, but it's still concerning

Maybe time to change your email password as well, as it can be an attack vector for someone trying to get into someones account.

And even if they know your login name and password, they'd still have to get through the 2FA with a code that has 60,466,176 combinations.