Read info below to protect your steam account. From what i know a few high profile accounts got hijacked this way.

How it works
This is how it works. There's a link, that APPEARS to end in ".png", under the pretense of your friend sending you a screenshot. If you click this link, it will download a .scr file, which will hijack your steam account. Your steam account will start to send the same link to your friends.

What to do
Don't click links ending "sshot721.png", or any link from "screen-lighting" website.
This is the only website they are using at the moment, so it's the one you should definitely not click. They may start using other websites though, so be vigilant.
Turn on Download Notifications in Chrome.
Chrome has a feature which will ask you if you want to download a file, before downloading it. By default, this is OFF. You can turn this feature on by going to "Settings", "Advanced Settings", and clicking the checkbox on "Ask where to save each file before downloading." This feature is enabled by default on Firefox.
Ask your friend if they sent that link
In a lot of cases, the friends have managed to retain access to the account. Since it is automatic, ask your friend if they sent the link to you. If they say no, then you know they are infected. If they do not answer, presume the same.