Fraudulent giveaway sites often use fake "Sign in with Steam" prompts to harvest login credentials and Steam Guard codes.
Scammers frequently contact indie developers posing as influencers or media reviewers to extort free keys, which are then fed into the random key market. The Security and Account Risk free random steam keys