Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.
BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people’s posts about games crashing, lost inventory items, and other technical issues.
The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.
These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.
Although ClickFix attacks require interaction from the victim, they are effective because they present users with what appears to be both a legitimate solution for a problem they are having.
Since the victim manually launches the command, the attack can also bypass some security protections that would otherwise automatically block executed malicious code.
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named “msf utility \ PC Opt.”
When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker.
However, most of these functions do not perform the tasks they claim. Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate.
The actual malicious activity is hidden in a function named ‘Advanced-Optimization’, which first disables TLS certificate validation and checks that it is running with administrator privileges. If it is not, the script displays an error stating that administrator rights are required and exits.
Once running with elevated privileges, the script creates the ‘C:\Windows\Background’ directory and adds it as an exclusion to Microsoft Defender’s scanning functions.
It also attempts to stop an existing scheduled task named ‘XMRig-[computer name]’ and terminates matching processes named ‘xmrig’ or ‘system’ that are running from the installation directory. It also attempts to delete any XMRig configuration files stored as C:\Windows\Background\config.json.
It is unclear whether this cleanup is intended to remove leftovers from an earlier install of the same malware or another miner already present on the device.
The malware then creates a temporary outbound Windows Firewall rule allowing connections to ‘msfconfig[.]icu’ over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file.
Before installing it, the script verifies that the downloaded file is not empty and is a valid executable. If so, it moves the file to C:\Windows\Background\system.exe.
So it launches every time Windows starts, it will create a new scheduled task named “XMRig-[computer name],” that launches the system.exe executable with SYSTEM privileges.
As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing.
Those who executed the command should check for the ‘C:\Windows\Background’ directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with ‘XMRig-‘.
If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds.
If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents.
Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Malicious sites use JavaScript to build malware in browser memory
Microsoft warns of surge in ACR Stealer attacks on customers
USB worm spreads crypto-stealing malware via Windows shortcut files
Steam Workshop abused to spread malware via Wallpaper Engine app
WordPress malware campaign hides payloads in Steam profiles
What was MS smoking when they set the “download a remote script” command to “irm” and “run a script” to “iex” and let one pipe directly into another? If this was at least and “get” command and a “run” command more people would have a chance to notice what exactly it it someone on the internet is telling them to do. What’s worse, the fact that you can skip https at the beginning lets the attackers make the command look like a windows applet. Microsoft could do a lot to make those kinds of attack harder.
They have had years to fix things, yet all they’ve done during that time is add more privacy-invasive bloat.
OpenAI confirms ChatGPT is down worldwide
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
Microsoft blames massive Microsoft 365 outage on maintenance bug
Calculate what you’d save by replacing your MDR.
Your Scanners Are Green. Your Pipeline Might Not Be. Here’s How to Close the Gap.
Rev5 is ending. See what your FedRAMP 20x transition really requires
Overdue a password health-check? Audit your Active Directory for free
AI agents can speed up ransomware attacks. See how Acronis helps reduce the risk.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
