Steam Bug - trade items went to duplicate user account (?)

[You cant see me brek]

Hello.
Recently I tried sending my friend all my tradable CS:GO items - I am having a break so I'd let him play with my skins (he agreed to give them back to me, he's a real life friend and no scammer).
I sent a trade offer to him, but when I went to confirm it on my phone it said that it is in fact not my friend's account, but an account which has the same profile pic and name. Upon seeing that I canceled the trade. My friend has then notified me that the offer in fact showed up on his profile and it says it has been canceled. So I thought that it's just a Steam mobile app bug of some sort and went ahead to making a new trade offer and confirming it. When I had done this, the items disappeared from my inventory and my friend has never received any trade offer. Now they are gone and my Steam trade history confirms that the trade took place - but with a strange duplicate level 0 account. What can I do?
I can't contact Steam Support because they don't give a crap about it apparently.

EDIT: I scanned my computer with Malwarebytes, refreshed all Steam Guard auntheticators, deleted the API and changed my password. Nothing has shown signs of intrusion.

This is what the trade history shows: 24 Feb, 2019
4:40pm
You traded with MatimusRex.
–UMP-45 | Urban DDPAT, G3SG1 | Desert Storm, Tec-9 | Army Mesh, UMP-45 | Urban DDPAT, G3SG1 | Jungle Dashed, AK-47 | Elite Build, SSG 08 | Blue Spruce, Glock-18 | Water Elemental, USP-S | Cyrex, AWP | Fever Dream, Music Kit | Daniel Sadowski, Total Domination, Sticker | Entry Fragger, Sticker | Perry, Sticker | Fearsome, M4A1-S | Decimator, Dual Berettas | Colony, Tec-9 | Isaac, Sticker | Distinguished Master Guardian (Holo), Souvenir MP5-SD | Lab Rats, Sealed Graffiti | Eye Spy (Blood Red), Nova | Mandrel, SCAR-20 | Sand Mesh, Sealed Graffiti | Popdog (Desert Amber), M4A4 | Magnesium, M4A4 | 龍王 (Dragon King), Clutch Case, Five-SeveN | Forest Night, Spectrum Case, MP7 | Forest DDPAT, Horizon Case, G3SG1 | Desert Storm, Horizon Case

[cSg|mc-Hotsauce]

1. NOT a bug.

2. Remove the links of the "other" account. (2nd link)

3. Follow all the steps...

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key https://steamcommunity.com/dev/apikey

[Punished bird]

Both of the profiles seem the same are you sure it's just not a delay?

[You cant see me brek]

Originally posted by cSg|mc-Hotsauce:

Remove the links of the "other" account.

Your account was compromised.

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key https://steamcommunity.com/dev/apikey

:qr:

Are you sure about that? As I wrote, he got the first trade offer (the one I canceled) even though it showed that it's not his account.

[You cant see me brek]

Originally posted by Nick Valentine:

Both of the profiles seem the same are you sure it's just not a delay?

To me they are not the same - one is added to my friends list and the other is not.

[Cathulhu]

No, Steam Mobile Authenticator does not block malware. Stop spreading misinformation.

[You cant see me brek]

Originally posted by Nick Valentine:

that's weird but you should listen to hotsauce maybe ask your friend if he has been to any suspicious sites since mobile guard should block most malware
:cozyfallout4:

I did do what hotsauce wrote, asked my friend about anything and he doesn't know nor suspect anything which could compromise the trade.

[Punished bird]

Well heck in a handbasket should have known i messed up

[ᏩℑᏕᎯϒ(づ￣ ³￣)づ]

Ez

[Punished bird]

What do you mean steam support dosen't care?

[You cant see me brek]

Originally posted by Nick Valentine:

What do you mean steam support dosen't care?

There is no way to contact them if trade is the issue - the only way to contact them via ticket is when regarding payments.

[Punished bird]

the only thing i can think of is for you to wait until more exprienced people help you out im still gonna ask you to check the trade more fully and fully make sure it's not somehow canceled

[You cant see me brek]

Originally posted by Nick Valentine:

the only thing i can think of is for you to wait until more exprienced people help you out im still gonna ask you to check the trade more fully and fully make sure it's not somehow canceled

In my trade history it shows as complete and accepted.

[cSg|mc-Hotsauce]

Which means you should follow all the steps above.

[Jerry]

To give you a bit of explanation what happened: At some point in the last year you have logged into an external website with your Steam data (knowingly or not), that has misused this to hijack your account. Since then a bot has been monitoring you, waiting for you to set up a high value trade. Said trade was instantly canceled while sending one to a sock puppet account, that took the name and avatar of your trade partner. This scheme has been around since last spring. The steps csg told you to follow are to lock them out of your account.

In the future do Steam browser logins only through the official main website of Steam (not even what appears to be profiles or trades). Legitimate websites will recognise the login and not ask for your name and password.

About the items you lost this time - gone for good, except if you somehow got hold of the thief yourself. Steam does not reinstate or duplicate items anymore.

[Punished bird]

Welp could be steam servers (but im probably wrong)