Steam users warned of sophisticated browser-in-the-browser phishing attack