Steam ClickFix attacks are targeting gamers with fake troubleshooting advice that installs XMRig cryptominers on Windows devices. The malicious replies appear in Steam discussion forums and claim to fix game crashes, lost inventory items and other common technical problems.
Instead of resolving the issue, the instructions trick victims into opening PowerShell as an administrator and running a malicious command. That command downloads and launches cryptocurrency-mining malware in the background.
Fake Steam support replies target frustrated gamers
The attackers create random Steam accounts and respond to forum posts from users asking for help. Their messages look like ordinary technical advice and offer what appears to be a quick fix.
Victims are told to open PowerShell with administrator privileges and paste in a command. Because the user launches the command themselves, the attack can evade some automated security protections.
This tactic is known as ClickFix. It relies on social engineering rather than a traditional exploit. Attackers present a fake error, verification step or repair instruction and persuade people to run the harmful command manually.
Fake Windows optimisation tool hides the malware
The PowerShell script used in the Steam ClickFix attacks poses as a Windows optimisation tool called “msf utility \ PC Opt.”
After it runs, the script displays messages about cleaning temporary files, flushing the DNS cache, updating drivers and checking the disk. It also claims to disable unnecessary startup programs, scan for malware and repair Windows system files.
Most of those functions are fake. The script only shows false progress messages and pauses for random intervals to make the process look genuine.
The real activity is hidden in a function called “Advanced-Optimization.”
Script weakens Windows security protections
The hidden function first checks whether it has administrator rights. If it does not, the script displays an error and stops.
When launched with elevated privileges, it creates a directory at C:\Windows\Background. It then adds that folder to Microsoft Defender’s exclusions, which can prevent Defender from scanning files stored there.
The script also looks for existing XMRig-related scheduled tasks and processes. It attempts to stop them and remove old configuration files before installing the new payload.
Researchers could not confirm whether this cleanup removes traces of an earlier infection or eliminates another cryptominer already running on the device.
XMRig miner gains SYSTEM-level persistence
The malware downloads an XMRig executable, checks that the file is valid and then stores it as system.exe inside the C:\Windows\Background folder.
Next, the script creates a scheduled task named XMRig-[computer name]. The task starts the miner every time Windows launches and runs it with SYSTEM privileges.
XMRig is a legitimate open-source mining tool, but cybercriminals frequently abuse it to mine cryptocurrency using victims’ computing power. Infected devices may experience high CPU use, overheating, slower performance and increased electricity consumption.
What to do if you ran the command
Never run PowerShell commands posted by unknown users in game forums, social media replies or comment sections. A genuine support fix should come from the game developer, Steam Support or another verified source.
Anyone who ran the command should check for these signs of compromise:
- The
C:\Windows\Backgrounddirectory - A Microsoft Defender exclusion for that folder
- A scheduled task beginning with
XMRig-
Run a full antivirus scan immediately. If the miner is not detected, manually remove the XMRig scheduled task, delete the Defender exclusion and remove the C:\Windows\Background folder.
Because the downloaded file may have performed additional actions, reinstalling Windows may be the safest option after a confirmed infection.
0 responses to “Steam ClickFix Attacks Install XMRig Cryptominers”