Steam confirmation message in Russian to my phone even when I have steam guard

[NPC A]

So last night, I got a steam confirmation message in Russian("Ваш код подтверждения Steam: KDHMJ") to my phone while I was sleeping.
Being quite terrified, I went through the basics. I changed my account's email, password, deauthorized all devices, changed password of the email connected to my account and so forth. I had steam guard verification through my email before, so I changed it to be verified through steam app since I thought this was where the security breach started.

I later checked steam login history and thankfully no login made last night and same with my email. So it does seem someone had my id+password but couldn't get in as they needed my phone number.

But I have a few questions if someone knows the answers.
1. Whenever a new login attempt is made, the certification code is given through the steam guard email. Why was this time given to my phone number?!
The only times I got a direct message from steam was only when I was changing my account settings.
But the strange thing is no login attempt made...same with email... so what??

2. What should I watch out for now? Again, I wouldn't be worried if it was only a verification code or new login attempt give in "email". Quite worried since I've never heard of such thing happen via a phone...

Thanks for any answers in advance:)

[Valeriya]

Did you receive this message in Russian by email?
Are you sure it was Steam that sent it to you?

Just revoke all permissions, hoping you have followed this guide:

1. Scan for malware https://www.malwarebytes.com/
2. Deactivate all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your mobile app (Steam guard) https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey
(there should be nothing in the APIKEY)

And avoid logging into third-party sites

[NPC A]

@Bluebird

Steam certification message in Russian was received via phone number
and yes, it was the same number Steam sends when you change account settings and they send you the verification number.

I am aware of security concerns and I already did your step 1~4.
Thanks for step 5 though, it's empty but didn't know there was such a thing.