Steam – Attacks Infect Gamers with XMRig Cryptominers

Overview

Cybercriminals are exploiting Steam discussion forums with ClickFix attacks, tricking gamers into running malicious PowerShell commands disguised as fixes for game crashes, lost inventory, or performance issues. Instead of solving problems, these commands install XMRig cryptominers, hijacking victims’ systems to mine cryptocurrency.

How the Attack Works

• Threat actors create random Steam accounts and reply to posts with supposed troubleshooting steps.
• Victims are instructed to open PowerShell as administrator and run a command.
• The command downloads a fake utility named “msf utility \ PC Opt”, which pretends to optimize Windows but secretly installs XMRig.

Fake Optimization Utility

The malicious script mimics legitimate maintenance tasks:

• Cleaning temporary files.
• Flushing DNS cache.
• Updating drivers.
• Scanning for malware.

In reality, these are fake progress messages designed to build trust. The hidden function, Advanced‑Optimization, performs the real malicious activity:

• Disables TLS certificate validation.
• Creates C:\Windows\Background and excludes it from Microsoft Defender scans.
• Downloads XMRig payload from msfconfig[.]icu.
• Installs it as system.exe and sets up a scheduled task named XMRig-[computer name] to run at startup with SYSTEM privileges.

Signs of Compromise

Gamers should check for:

• C:\Windows\Background directory.
• Microsoft Defender exclusions pointing to that path.
• Scheduled tasks beginning with XMRig-.

If found:

• Run a trusted antivirus scan.
• Remove the scheduled task and Defender exclusion.
• Delete the C:\Windows\Background folder.
• Consider a full OS reinstall to ensure no hidden payloads remain.

Why ClickFix Works

• Social engineering: Victims believe they’re fixing real problems.
• Manual execution: Since users run the commands themselves, some security tools fail to block the malware.
• Trusted platform abuse: Steam forums provide credibility, making the fake fixes seem legitimate.

Expert in the Cloud Insight

ClickFix attacks highlight the danger of blindly trusting forum advice. By exploiting gamers’ frustration with technical issues, attackers bypass traditional defenses and gain persistence on systems. The lesson is clear: never run PowerShell commands from unknown sources, even if they appear helpful. For enterprises, this is another reminder that social engineering remains the most effective attack vector — training and vigilance are as critical as technical defenses.