Steam forums used to infect gamers with a cryptominer disguised as game “fixes”

A ClickFix campaign has taken hold on Steam's discussion forums: attackers pass off malicious commands as fixes for technical problems, when in reality they infect victims' computers with the XMRig cryptominer. BleepingComputer was tipped off about it by one of its readers.

How the attack works

The attackers create random accounts and reply to posts from users complaining about game crashes, items vanishing from their inventory and other glitches. In their replies they advise opening PowerShell with administrator rights and running a certain command that supposedly fixes everything. In reality, the command quietly downloads and launches the miner's executable.

This is a textbook example of ClickFix social engineering: the victim is shown a fake error or troubleshooting instruction and nudged into manually running malicious code. The trick works because the person is offered a seemingly plausible solution to their own problem. What's more, since the user runs the command themselves, the attack bypasses some of the protective mechanisms that would have blocked automatically executed code.

A bogus Windows optimizer

The script masquerades as an optimization tool called “msf utility PC Opt.” When launched, it displays messages about all sorts of maintenance work: clearing temporary files, flushing the DNS cache, updating drivers, checking the disk, disabling unnecessary startup items, scanning for malware and repairing system files. Most of these functions do nothing at all — they merely show fake progress indicators and hold a random pause of between 1.5 and 8 seconds to make the tool look convincing.

The real malicious logic is hidden in the Advanced-Optimization function. It disables TLS certificate validation, demands administrator rights, creates the C:\Windows\Background directory and adds it to the Microsoft Defender exclusions. The script then creates a temporary firewall rule for connections to the host msfconfig[.]icu on port 443, downloads the payload from there, saves it as system.exe and creates a scheduled task named “XMRig-[computer name]” that runs the miner with SYSTEM privileges every time Windows starts. Curiously, before installing, the script tries to erase the traces of a previous miner — whether its own or a competitor's is unclear.

What to do

The main rule is simple: never run PowerShell commands suggested by strangers on forums, even if they're framed as a fix for your problem. Anyone who has already run such a command should check for the C:\Windows\Background directory, an exclusion for it in Defender and any task with a name starting with “XMRig-.” If signs of infection are found, run an antivirus scan, and if that fails, manually delete the task, the exclusion and the directory itself. BleepingComputer notes that the most reliable option is to reinstall the system: there's no way to know what else the downloaded payload got up to.

Source: Bleeping Computer