[A steam user] sent me a friend request, and when I accepted, he sent me a message that linked me to a website that looked exactly like the normal steam community site, asking me to upvote this item.

The intent is that it looks like steam, but it isn't, so it opens in a normal web browser that looks exactly like the real steam webpage where you are not signed in, and when you "sign in" with your username and password, they take that data and use it to sign in to your actual steam account where they snipe all of your items and resell them on gambling sites for cheaper than what you find on the community market.

That's not all; if your password is the same between your email and your steam account, they can sign into your email and use it to reset passwords on other websites, say your pay paI account or your google play store account.

Stay safe out there!