Steam forum ClickFix attacks infect gamers with XMRig cryptominers
Source Bleeping Computer
Description
Steam discussion forums are being exploited in ClickFix social engineering attacks where threat actors post fake fixes for game or computer issues. Victims are tricked into running PowerShell commands that download and install the XMRig cryptominer on their devices. The malicious script masquerades as a Windows optimization utility but disables security features, installs the miner with SYSTEM privileges, and persists via scheduled tasks and Microsoft Defender exclusions. Users executing these commands risk unauthorized cryptocurrency mining on their systems.
Impact
Successful execution results in the victim's device being infected with the XMRig cryptominer, which uses system resources for unauthorized cryptocurrency mining. The malware runs with SYSTEM privileges, evades Microsoft Defender detection by adding exclusions, and persists via scheduled tasks. This can degrade system performance and increase power consumption. There is no indication from the data that additional payloads or further compromise beyond cryptomining have been confirmed.
Defensive guidance
No official patch or vendor fix is applicable as this is a social engineering attack vector. Users should never run PowerShell commands from untrusted sources, especially in forums. To remediate infections, check for the presence of the 'C:\Windows\Background' directory, Microsoft Defender exclusions for that path, and scheduled tasks named 'XMRig-[computer name]'. Run a full antivirus scan to detect and remove the miner. If the miner is not detected by antivirus, manually remove the scheduled task, delete the Defender exclusion, and remove the installation directory. Reinstalling the operating system may be necessary to ensure complete removal and to mitigate any unknown additional malicious activity.
Summary
Threat actors abuse Steam forums by posting replies with PowerShell commands claiming to fix common gaming or system problems. When executed by victims, these commands download and install the XMRig cryptominer. The PowerShell script pretends to be a Windows optimization tool, displaying fake progress messages while disabling TLS certificate validation and Microsoft Defender scanning for the installation directory. It creates a scheduled task to run the miner with SYSTEM privileges at startup and modifies firewall rules to allow outbound connections to the attacker's server. This ClickFix attack relies on social engineering to bypass security controls by requiring manual victim interaction.