Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers
Gamers browsing Steam’s discussion forums have been hit by a new wave of social engineering attacks that claim to offer fixes for common game and computer issues. However, these “ClickFix” scams actually inject malware into devices, turning them into cryptocurrency miners. The threat actors behind this campaign are creating fake Steam accounts to post helpful-looking solutions to problems like games crashing or lost inventory items.
Once a gamer clicks on the supposed fix and runs the PowerShell command provided, the malicious script quietly downloads an XMRig miner executable and launches it on their computer. This type of attack is particularly insidious because it requires direct interaction from the victim, making it harder for security software to detect. The attackers rely on the fact that many users will blindly run commands provided by others in online forums, thinking they are getting help with a legitimate problem.
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility called “msf utility \ PC Opt.” When launched, it displays fake progress messages and pauses to mimic real maintenance tasks. However, its true purpose is hidden behind a function named ‘Advanced-Optimization,’ which first disables TLS certificate validation and checks for administrator privileges.
If the script runs with elevated privileges, it creates a directory in Windows Background, adds an exclusion to Microsoft Defender’s scanning functions, and attempts to stop any existing scheduled task or processes related to XMRig. It then downloads the XMRig miner payload from a remote server, verifies its integrity, and moves it to the system.exe executable, which launches every time Windows starts.
Those who have fallen victim to this scam should be on high alert for signs of compromise. Check your computer for a directory named ‘C:\Windows\Background,’ an exclusion in Microsoft Defender’s scanning functions for that path, or a scheduled task beginning with ‘XMRig-.’ If you find any of these indicators, immediately run an antivirus program to scan for malware and remove anything it finds.
If the antivirus software doesn’t detect the miner, manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents. As a last resort, consider reinstalling your operating system to ensure you’re not leaving any backdoors open for further malicious activity.
The key takeaway from this attack is that gamers should never run PowerShell commands provided by unknown users in discussion forums, no matter how legitimate they may seem. Always verify the authenticity of solutions before running them on your computer.
Source: Bleeping Computer — 2026-07-25