Attackers are actively abusing Steam discussion boards to distribute cryptocurrency mining malware through a social engineering technique known as ClickFix. Disguised as helpful fixes for game crashes, lost inventory items, or other technical issues, the fraudulent posts instruct users to execute PowerShell commands that covertly download and install the XMRig miner.
The campaign was brought to light by a reader tip to BleepingComputer. Malicious actors create new Steam accounts to reply to genuine help requests, presenting what appears to be a legitimate solution. The recommended “fix” involves running PowerShell with administrator privileges, but the supplied command initiates a surreptitious infection chain.
ClickFix attacks rely on victims manually executing malicious code under the guise of resolving a problem. Because the user initiates the action, some security controls that would normally block automated threats may be bypassed, increasing the likelihood of a successful infection.
The PowerShell script used in this campaign masquerades as a system optimizer called “msf utility \ PC Opt.” It displays a series of bogus maintenance messages—such as cleaning temporary files, flushing DNS, updating drivers, and scanning for malware—while pausing for random intervals. These fake progress indicators are designed to make the utility appear authentic.
Behind the scenes, the script performs its true payload delivery through a function named ‘Advanced-Optimization’. It first disables TLS certificate validation and verifies it is running with administrator rights; if not, it halts with an error. Once elevated, it creates the directory `C:\Windows\Background` and adds it as a Microsoft Defender exclusion, ensuring the miner remains undetected.
The script also attempts to terminate any existing XMRig processes or scheduled tasks, and deletes previous configuration files. It is unclear whether this cleanup targets earlier instances of the same malware or competing miners already present on the machine.
A temporary outbound Windows Firewall rule is created to allow the script to contact the domain `msfconfig[.]icu` on port 443 and download the XMRig payload from `https://msfconfig[.]icu:443/tmp/system.txt`. The downloaded file is checked for validity before being saved as `C:\Windows\Background\system.exe`. Persistence is achieved by creating a scheduled task named `XMRig-[computer name]` that launches the miner with SYSTEM privileges at startup.
Users who have executed such commands are advised to look for indicators of compromise, including the `C:\Windows\Background` directory, a corresponding Defender exclusion, and the scheduled task. Immediate antivirus scanning is recommended. If automated tools fail, manual removal steps include stopping and deleting the scheduled task, removing the Defender exclusion, and wiping the directory. However, a full operating system reinstallation may be the safest recourse, as the script could have performed additional unseen actions.
This campaign underscores the risks of following unverified instructions from online forums. As a rule, PowerShell commands from unknown sources should never be executed, even when they appear to address a known issue.
See an error? Read our corrections policy or email [email protected].
