one more suggestion: Never fill in your steam credentials on another site. If you're logged in at https://steamcommunity.com , you'll only have to confirm to log in:
And: Your authenticator is the final step, and the hardest step to fake. Always triple-check any trade you confirm there.
If anything is off there, change your password, check for api keys at https://steamcommunity.com/dev/apikey and renew your tradeoffer url.