Scam bots are malicious software that steal your Steam credentials via phishing websites or email spam. You may not even be suspicious, because often phishing websites look exactly like the original ones (the only difference is the URL, which cannot be duplicated). If you log in to a phishing website via Steam, your credentials are compromised.