Cybercriminals are abusing Steam discussion forums to spread a ClickFix social engineering attack that disguises malware as a solution for common gaming and PC issues.
The campaign uses fake support replies to convince users to run malicious PowerShell commands that secretly install a cryptocurrency miner on their Windows computers.
The attackers create fake Steam accounts and respond to forum posts about game crashes, missing inventory items, and other technical problems. Their replies claim to offer a quick fix by asking users to open PowerShell as an administrator and paste a command. While the command appears to solve the problem, it actually downloads and launches the XMRig cryptocurrency miner in the background.
This attack uses the increasingly popular ClickFix technique, where victims are tricked into manually executing malicious commands by following what look like legitimate troubleshooting steps. Because the user starts the command themselves, the attack can bypass some automated security protections that normally block malicious software.
The PowerShell script pretends to be a Windows optimization tool called “msf utility \ PC Opt.” It displays convincing messages about cleaning temporary files, flushing the DNS cache, updating drivers, checking disks, disabling unnecessary startup programs, scanning for malware, repairing Windows, and running the System File Checker. In reality, most of these actions are fake and only show progress messages with random delays to make the program appear genuine.
The real malicious behavior is hidden inside a function called Advanced-Optimization. After confirming it has administrator privileges, the script disables TLS certificate validation, creates a C:\Windows\Background folder, and adds that location to Microsoft Defender’s exclusion list so the malware is less likely to be detected.
The script also removes traces of previous XMRig installations before downloading a fresh XMRig executable from a remote server. The downloaded file is saved as system.exe inside the C:\Windows\Background directory. To ensure it survives reboots, the malware creates a scheduled task named XMRig-[computer name], which automatically launches the miner with SYSTEM privileges whenever Windows starts.
Anyone who followed these instructions should immediately inspect their system for the C:\Windows\Background folder, Microsoft Defender exclusions pointing to that directory, and scheduled tasks beginning with XMRig-. Running a reputable antivirus scan is strongly recommended. If the miner is not detected automatically, users should manually remove the scheduled task, delete the Defender exclusion, and remove the malicious folder and its contents. Because it is impossible to know whether additional malware was installed, performing a clean Windows reinstall may be the safest option.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
This incident serves as another reminder that PowerShell commands shared by unknown users on online forums should never be trusted, even if they appear to be legitimate fixes for a problem you are experiencing.
