You've probably logged into an scam/fake site to f.e. gamble, trade, buy or sell skins. You logged in through your steam acc on that site but actually it just farmed your* login details. All they have to do is then monitor your login attempts with authenticator and they're in, they just fast copy paste the codes.
Also if you want, I can later today search an Insta-reel from Aethix which shows you how to make sure you never get scammed. Because one thing I noticed is that you can login on your steam acc on the real steamcommunity website and then when you visit f.e. cs.money and it again asks you to login, you shouldn't do that and immediatly exit the site you were trying to visit. It's kinda hard to explain, but in the vid this guy shows you how to protect your account in a few mins, ez steps.