Steam Forum ClickFix Scam Silently Installs XMRig Cryptominer via Fake PowerShell Fixes
Threat actors are exploiting Steam discussion forums with ClickFix social engineering, tricking gamers into running malicious PowerShell commands that secretly deploy XMRig miners.
A new social engineering campaign is targeting Steam users through discussion forums, where attackers pose as helpful community members and offer fake fixes for game crashes and technical glitches. The scheme, known as ClickFix, tricks victims into running a seemingly innocent PowerShell command that silently downloads and installs an XMRig cryptominer, hijacking system resources for illicit cryptocurrency mining.
The attackers create disposable Steam accounts and reply to posts about game errors, lost inventory, or performance issues. Their messages instruct users to launch PowerShell as an administrator and paste a provided command. When executed, the script masquerades as a Windows optimization utility called “msf utility \ PC Opt,” displaying fake progress messages for tasks like cleaning temporary files, flushing DNS, and scanning for malware. These actions are merely delays to make the script appear legitimate while the real payload is deployed stealthily.
Under the hood, the script disables TLS certificate validation, checks for administrator privileges, and creates a directory at 'C:\Windows\Background'. It then adds this path to Microsoft Defender’s exclusion list to evade detection. The malware also attempts to remove any existing XMRig scheduled tasks or processes before connecting to 'msfconfig[.]icu' over TCP port 443—temporarily allowed via a new Windows Firewall rule—to download the miner executable. The payload is saved as 'system.exe', and a scheduled task named “XMRig-[computer name]” ensures it runs at every system startup with SYSTEM-level rights.
For website operators and IT teams, this campaign highlights how easily social engineering can bypass technical defenses by targeting human trust. While the attack initially focuses on gamers, similar tactics could be used in support forums frequented by employees, leading to broader network compromises. Users should never execute PowerShell commands from unverified sources, no matter how appealing the offered fix sounds. If you suspect infection, check for the 'C:\Windows\Background' directory, a matching Defender exclusion, and any scheduled task starting with “XMRig-”. Removal involves deleting these artifacts and running a full antivirus scan, though a clean OS reinstall is the safest path. Incorporating a security-focused DNS service like AEU DNS can strengthen defenses, as it blocks access to known malicious domains such as the one used in this campaign, adding a crucial layer of protection against initial infection.