How effective is phishing?

I can't see why so many people (or rather, bots) are phishing.

Even if someone does click a blindly obvious-phisher link and lose their account/items, theres still the SteamGaurd "Can't trade for 7 days on new device" thing stopping scammers. By the time a week is up, Im sure Steam has been contacted by the victim and Steam has sorted the issue out

Or am I completely wrong?

The virus uses the remember your password function to log into your account, break the trade offer captcha and send all of your items away on your own computer.

Well, since the captcha has been added recently they just have yet to adapt to it. its only few that can. But that will happen and when its that far, something else will change.

But in general, indeed, the infection uses the users own computer to start steam, auto-trade to a mule account, that has another bot installed to autoaccept trade offers that are empty for its own items.

Its so stupid that they just execute some file they don't know any about.