Get your friend to lock his account, then contact support, he be needing to provide proof of ownership to get account back.

https://help.steampowered.com/en/wizard/HelpWithAccountStolen

https://support.steampowered.com/kb_article.php?ref=2347-qdfn-4366

Name shaming isn't allow on the forum, also you simply report the user, and block. Support will look into it, and will take action if seem correct by report.

Steps your friend will need to take:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://gtm.steamproxy.vip/dev/apikey (there should be nothing in the APIKEY)

Only problem with that is the only way I have of contacting him is through steam... I've tried messaging in some of his small groups to see if maybe anyone knew him and could talk to him, but no responses so far. Also I did report them, but it was for being part of a scam rather than suspecting their account was hijacked.

Not much left to say, it's up to your friend to get his account back on his own, just move on with your day as there's nothing else you can do, but inform him.

Here some advice that can be shared.
- Never share login details with others, or over public, or private controlled service or network.

VPN are hubs which data could be collected and wouldn't know about it.

If using school network, or etc someone at IT can either collect, or record inputs.

Services such as Facebook, discord, or etc can be review by someone that has access to company system can view all collected message, and data uploaded.

- Do not login from 3rd party websites, often enough there scam sites that makes fake pages to trick you into giving your login details.

- Do not download, and install unknown software if you're not sure what it is, don't want virus/backdoor happening.

- It's not recommended to use same logins details for everything, also good it's a good idea to add 2FA if service supports it. For Steam they have an app.
https://support.steampowered.com/kb_article.php?ref=4440-rtui-9218

For email service such as outlook, Gmail, or etc may support Google Authenticator.

- If anyone claiming to be admin, work for, working with support, or etc to claim to be whomever, report them, and block them as it be a scam to try either get you to hand account to them, or take your items. They even try to send fake video/gif showing your profile, and claim of doing false report, and say you have pending bans which are common tricks and lies, as there no pending bans, and wouldn't get inform of such either, as support don't need to, nor need to contact you at all, the only time support ever reply is when you contact them first, and that's only over the support ticket, not by chat, or friend request.

- Also if have account hijack, and items are being traded, ensure to try get account back asap which there are trade holds which takes 15 days, and can cancel that trade within those 15 days from the moment trade was made, to revert the trade from happening.

If you do not know this person in real life, with any other outside contact, do nothing more. Their account is their problem.

This just happened with one of my friends today. Shame.

anyone that falls for these "scams" ( more than likely trying to get something for nothing) deserve it. there are numerous warnings everywhere.

He got his account back. The only people that deserve to get scammed are the scammers that take advantage of people's trust.

tell him to stop playing COnqueuer's blade.