Steam Forum Hackers Prey on Gamers with Cryptominer Malware
A wave of cyber attacks has been targeting Steam forum users, exploiting their trust in online communities to spread cryptominer malware. These “ClickFix” attacks pose as helpful solutions to common gaming problems but actually install malicious software on victims’ devices.
Threat actors are creating fake Steam accounts to post phony fixes for game and computer issues, such as crashes or lost inventory items. They then respond to posts from other users, instructing them to run a PowerShell command that appears to resolve the problem. Unbeknownst to the victim, this command quietly downloads an XMRig miner executable and launches it on their computer.
The malware masquerades as a Windows optimization utility named “msf utility \ PC Opt,” displaying fake progress messages and maintenance tasks to make it seem legitimate. However, its true purpose is to disable security features, such as TLS certificate validation, and create a backdoor for the miner to run undetected.
Once installed, the malware creates a temporary outbound Windows Firewall rule allowing connections to a remote server, which downloads the XMRig payload from a URL hosted on that server. The script then verifies the downloaded file’s integrity before moving it to the system directory, where it launches every time Windows starts.
These ClickFix attacks are effective because they require interaction from the victim, making them more difficult for security protections to detect. They also exploit users’ trust in online communities and their willingness to follow instructions provided by others.
The malware’s cleanup function is particularly intriguing, as it attempts to remove leftovers from an earlier install of the same malware or another miner already present on the device. This raises questions about whether this is a deliberate attempt to remove competing miners or simply a side effect of the malware’s design.
In any case, users should exercise extreme caution when running PowerShell commands provided by unknown individuals in online forums. If you’ve fallen victim to one of these attacks, check for signs of compromise such as the “C:\Windows\Background” directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with “XMRig-“.
If you find any of these indicators, immediately run an antivirus program to scan for malware and remove anything it finds. If your antivirus software fails to detect the miner, manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents.
In light of these attacks, it may be wise to exercise an additional layer of caution when interacting with online communities. Always verify the authenticity of instructions provided by others and never run unknown PowerShell commands.
Source: Bleeping Computer — 2026-07-25