Dunno if it is a recent campaign or my steam friend was just unlucky,
but if you receive a steam message like this maybe **don't** scan the QR Code-
pretty sure that's how you get sent somewhere where you ultimately get hacked, just like they probably were