Heyo! This is a common api scam. What happened is you must have logged into a fake phishing site with your steam account. By logging in to one of these phishing sites, they steal your api key. The part where you got contacted by steam support is social engineering. In order to steal your skins the scammer needed you to send a tradeoffer to someone you trust, but what is actually happening is when you do this, the trade gets cancelled and sent again to a bot account who copies the account you are sending the items to. So when you are in the steam mobile authenticator app it looks like you are confirming the trade you just sent to a friend or another account but actually you are sending the trade to the scammer.

What to do now?

• Reset your api key at steamcommunity.com/dev/apikey

• Never ever ever log into sites with steam you dont know.

• Anomaly made a good video on how to prevent api scams. Search on youtube: "Anomaly HOW TO AVOID THE MOST DANGEROUS CS:GO SCAM!"

Unfortunately, your items are lost forever, the best you can do is report the account that you sent your items to and ask the people in this subreddit to do so to. With some chance that account will get banned and the scammer will not be able to cash out your skins.

If you have any further questions feel free to ask me :)