Cybercriminals are targeting Steam users through fraudulent troubleshooting posts that exploit the increasingly common ClickFix social engineering technique, tricking gamers into manually executing malicious PowerShell commands that ultimately install cryptocurrency mining malware on Windows systems.
Rather than relying on software vulnerabilities, the campaign abuses trust within Steam's community discussion forums. Attackers reportedly create newly registered accounts and respond to users seeking help with problems such as game crashes, missing inventory items, or other technical issues. Their replies appear to offer legitimate troubleshooting steps, encouraging victims to launch Windows PowerShell with administrator privileges and paste a command that supposedly resolves the issue.
Instead of fixing the reported problem, the command downloads and installs XMRig, an open-source cryptocurrency mining application that has frequently been repurposed by cybercriminals to mine Monero using victims' computing resources without their knowledge or consent.
The campaign reflects the continued rise of ClickFix attacks, a social engineering method that persuades users to execute malicious commands themselves. These attacks typically imitate security checks, CAPTCHA verifications, software updates, or troubleshooting instructions that appear credible because they are presented as solutions to an existing problem. Since the victim willingly launches the command, the activity may evade security controls designed to block automatically executed malware.
The PowerShell script distributed in this campaign disguises itself as a Windows optimisation utility named "msf utility \ PC Opt." Once started, it displays what appear to be routine maintenance operations, including cleaning temporary files, flushing the DNS cache, updating drivers, checking disk health, disabling unnecessary startup applications, scanning for malware, repairing the Windows image, and running the System File Checker.
However, these operations largely serve as a visual distraction. Instead of performing meaningful system maintenance, the script displays convincing progress messages and introduces short delays to create the impression that legitimate optimisation tasks are taking place while malicious actions occur in the background.
The script's primary malicious routine first disables Transport Layer Security (TLS) certificate validation before confirming that it has been launched with administrator privileges. If elevated permissions are unavailable, execution stops after displaying an error requesting administrative access.
Once running with the required privileges, the malware establishes persistence by creating a directory within the Windows installation path and modifying Microsoft Defender settings to exclude that location from antivirus scanning. Excluding a directory from security scans reduces the likelihood that the installed malware will be detected or quarantined.
The script also checks for traces of previous installations by attempting to stop an existing scheduled task associated with the miner, terminating related processes, and removing older configuration files. While the exact purpose of this cleanup remains uncertain, it may help replace an earlier installation or remove conflicting miner components before deploying a fresh payload.
To retrieve the malware, the script temporarily creates an outbound Windows Firewall rule permitting network communication with an attacker-controlled server over TCP port 443. After downloading the payload, it verifies that the retrieved file is both non-empty and a valid executable before moving it into its final installation directory.
To maintain long-term access, the malware creates a scheduled Windows task configured to launch the XMRig executable automatically whenever the operating system starts. The task executes with SYSTEM privileges, giving the miner elevated permissions while allowing it to continue operating after reboots.
XMRig itself is a legitimate open-source cryptocurrency miner designed for authorised mining operations. However, threat actors frequently misuse the software in cryptojacking campaigns because it efficiently mines the privacy-focused cryptocurrency Monero, allowing attackers to generate revenue by exploiting compromised computers' CPU resources. Victims often experience unusually high processor usage, increased power consumption, system slowdowns, excessive fan activity, and reduced hardware lifespan.
This indicates a new wave in cybercriminal tactics. Rather than exploiting software flaws, attackers increasingly rely on convincing users to compromise their own systems through social engineering. ClickFix campaigns have been observed across multiple platforms in recent months, targeting individuals through fake browser alerts, fraudulent technical support pages, counterfeit software updates, and deceptive verification prompts.
Users should exercise caution when following technical advice posted by unknown forum members, particularly when instructions require launching PowerShell, Command Prompt, or other administrative tools. Legitimate game support rarely requires manually executing complex commands obtained from public discussion forums.
Systems that may have been exposed should be examined for unexpected scheduled tasks related to XMRig, suspicious Microsoft Defender exclusions, and unfamiliar files or folders created within protected Windows directories. A full antivirus scan should be performed immediately, and any malicious scheduled tasks, Defender exclusions, or installed payloads should be removed. Where compromise cannot be confidently ruled out, performing a complete operating system reinstallation may provide the most reliable method of restoring system integrity, as additional malicious activity may have occurred after the initial infection.
