Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers

Gamers Targeted via ClickFix Attacks on Steam Discussion Forums

A new ClickFix social engineering campaign is targeting PC gamers through Steam discussion forums, weaponizing the platform's help threads to deliver XMRig cryptocurrency miners to Windows users. The campaign was discovered and reported by BleepingComputer on July 25, 2026, after a reader flagged a suspicious forum post.

How the Attack Works

The Social Engineering Lure

Attackers create throwaway Steam accounts and monitor discussion threads where users report technical problems — game crashes, missing inventory items, corrupted save files, and similar complaints. They then reply posing as experienced community members with a "fix."

The reply instructs the victim to open a PowerShell terminal as Administrator and paste in a command — a classic ClickFix technique that has been increasingly used to deliver malware since mid-2024. The victim, already frustrated and looking for a solution, is primed to follow the instructions without scrutiny.

The PowerShell Payload

The malicious PowerShell script masquerades as a legitimate Windows optimization tool called "msf utility \ PC Opt". It displays convincing fake maintenance messages with randomized delays to appear authentic:

Cleaning temp files...
Flushing DNS cache...
Updating drivers...
Optimizing startup...

Buried inside the Advanced-Optimization function, the script silently performs the actual attack:

1. Disables TLS certificate validation to prevent detection during download
2. Verifies administrator privileges are available
3. Creates the directory C:\Windows\Background (mimics a legitimate system path)
4. Adds a Microsoft Defender exclusion for C:\Windows\Background
5. Terminates any existing XMRig processes or config files
6. Creates a temporary Windows Firewall rule allowing outbound TCP 443 to msfconfig[.]icu
7. Downloads XMRig from https://msfconfig[.]icu:443/tmp/system.txt
8. Moves it to C:\Windows\Background\system.exe

Persistence

The miner persists across reboots via a Windows Scheduled Task:

• Task name: XMRig-[computer-name]
• Trigger: Every Windows startup
• Privilege level: SYSTEM — the highest available on Windows

Once installed, XMRig silently mines Monero (XMR) cryptocurrency for the attacker using the victim's CPU, with Microsoft Defender completely blinded to the C:\Windows\Background directory.

Indicators of Compromise

Removal Steps

If you suspect your system has been infected:

1. Open Task Scheduler (taskschd.msc) and delete any task named XMRig-[computer-name]
2. Remove the Defender exclusion — open Windows Security → Virus & Threat Protection → Manage Settings → Exclusions → remove C:\Windows\Background
3. Delete C:\Windows\Background and all its contents
4. Run a full antivirus scan with updated definitions
5. If you cannot determine the full extent of the infection, reinstall the OS — the scheduled task runs as SYSTEM, which means the attacker had full system access

Why ClickFix Works

ClickFix attacks are effective because they exploit trust and context. A user who just posted a problem on a forum is actively seeking help. An authoritative-sounding reply with specific instructions is exactly what they're hoping for. The "run this PowerShell command" vector also bypasses many browser-based security controls that would stop a traditional file download.

This broader ClickFix trend is not isolated to Steam. The FBI's Seattle Division has separately been investigating at least seven Steam games that installed info-stealing malware (Vidar, HijackLoader, Fickle Stealer) between May 2024 and January 2026, suggesting ongoing attacker interest in gaming platforms as a distribution vector.

Prevention

• Never run PowerShell commands sourced from strangers, regardless of how legitimate they appear or how confident the poster sounds
• Be especially suspicious of commands that require running as Administrator
• Verify "fixes" against official game support channels or well-known community hubs like Reddit, not random forum replies
• Report suspicious posts using Steam's built-in reporting tools
• Consider enabling PowerShell constrained language mode on gaming machines if you don't need unrestricted scripting

References

• BleepingComputer — Steam forum ClickFix attacks infect gamers with XMRig cryptominers