I am also finding that exclusively logging in with .WebBrowser (and not .MobileApp) and using a non-default User-Agent (just pull whatever your current browser uses) works.
Account now is blocked from selling for 15 days, but at least I can play on VAC servers.
Created an account and replying to say I'm also experiencing this. Starting Sunday, I logged in using a QR code that I scanned with the Steam Authenticator app. I was then flagged for "compromised account". I went through their flow to reset my password and figured all was good so I logged in again with QR code. Flagged again. This time they did a big reset and I even had to remove and re-attach my Steam Authenticator. I tried one more time and my account got flagged and that's where I'm stuck right now. It's a big pain because it prevents me from joining friends.
tl;dr: something does seem broken when using QR codes to log in
@vindisel I found in the github why your EAuthTokenPlatformType.MobileApp shows up as [Samsung] Galaxy S22: https://github.com/DoctorMcKay/node-steam-session/blob/a4300c954c7dc0e4b15c6ff033e4484c70837a0f/src/AuthenticationClient.ts#L417
Basically anybody using .MobileApp as their type gets considered to be an S22. My original login method was also using .MobileApp.
I'm currently trying to change .MobileApp to .WebBrowser to see if that does anything, because since I'm running my code on a server it's not actually a MobileApp. Maybe Valve is cracking down on "wow there's a lot of people doing bot things from S22s"? I'm also going to provide a userAgent from my current browser, in case that helps avoid this automatic flagging.
Ian got a reaction from vindisel in I get my account banned when I log in with a QR code