There is only one way to be hacked on Steemit and that is when you give away your password or keys to someone else. No sane person likes to give the keys away just like that so hackers have to work hard. Unfortunately, hackers are smart people too and they have developed techniques to hack other people. What a negative use of IQ and ability!
One such technique is called phishing. Phishing attacks are rampant these days!
...the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
My Friends Have Been Phished Already!
Phishing is what has happened with two of my Steemit friends so far. One of them is 
Her account was hacked through a phishing link and then used to spread the same phising link (because password/keys are compromised). She was so depressed because Steemit matters a lot and means a lot more than just a website. How do I know this? Because I interact with a lot of people around the globe and they share their issues with me; especially when they pertain to Steemit.
It was a depressing time. It would be for you too if your account is hacked and all your Steem/SBD is stolen. As a result of posting phishing links (hacker did that), she (her account) was flagged to 0 reputation score. Losing funds is one issue. Losing all the reputation is another. I had to counsel her and asked her to stay calm because everything will be good again.
Her account was recovered and the reputation score reverted back to the previous one after removal of flags. But the problem of lost funds still remained. To pull her out of that depressing scenario, I promised her that her loss will also be recovered. Guess what? Payout of this post will be utilized to send her all the funds she lost. So, do contribute with your votes to help a fellow Steemian.
How to Avoid Phishing Attacks?
Let's start by understanding what phishing is. Phishing and fishing sound similar because both have the same purpose; to induce to do something that is harmful. Some sort of a bait is used for both. While fishes like insects and stuff, people free money and stuff. Hackers offer some attractive thing and provide a link where that thing, free tokens for instance, is supposedly available.
When you click the link, you are taken to a sign in page of the website. The page asks you to enter your username and password. You do that considering it's Steemit asking for your password. But it's not Steemit. It's something like Steemît, Steêmit, Steemlt, Steemt, Steemiit, Stemit, Steemit.in, Steemit.cn, Steemit.me etc. etc.
In simple words, if you enter your credentials, you have been hacked and all your liquid funds will soon be taken out of your account. It can be a big loss depending on how much money you have in your wallet, or how much the amount mattered to you. I can afford to giveaway 15 Steem and 10 SBD in a single contest but 15 Steem is a considerable amount for many Steemians. What I mean to say is that a loss is a loss, no matter how big or small it seems to us.
Rule # 1 : DO NOT CLICK EXTERNAL LINKS
In a comment or a post from a dubious account, if you see a link which takes you outside Steemit, DO NOT click it. If it is a phishing link, your username and password is going to be compromised if you are not careful enough. External links are clearly marked with a sign these days. Here's an example from this post by 
The link to my blog is an external link and you can see the indication icon. All phishing links are external links. Do not click external links directly, never from doubtful sources (or an already compromised account).
Rule # 2 : Copy External Links, Paste in Browser, Examine and Only Then Visit Trusted Links!
Saftey comes with some inconvenience. You will have to do it to minimize the risk or hacking. If you are okay with losing your money, be lazy and click whatever you come across. But if you wish to keep your account safe from hackers and phishers, then do the following.
- Right click/long press the link and copy link address.
- Paste the link in your browser and examine it. If it's one on the Stéèmit.com type, do not open it.
If it seems legit, you can open it.
But if upon opening it asks you to give your username and password, do not enter your information at all. (SteemConnect logins are exception to this because the app is trusted).
But even SteemConnect can ve SteemConñet, SteemÇonnect, SteemCónnect or any combination of deceiving spellings. So, you have to be very vigilant.
Stay Safe!!!
I hope you understand phishing and how it works (if you didn't know already). I thought it's important to educate people about the risk of being hacked through phishing after seeing people hacked. I also hoped to recover losses of one of the victims through the payout of this post (because it will be a community powered rescue mission).
It is up to you to resteem this post to make people aware and safe. Your upvote will contribute in recovering the loss of a fellow Steemian, as well as give some visibility to this post.
Thanking you all I remain,
Ilyas Tarar