Steam forum ClickFix attacks infect gamers with XMRig cryptominers

The Incident: A "Fix" That Breaks Your PC

Recently, threat actors have been active on Steam discussion forums. They post what appear to be helpful solutions for common game crashes or inventory issues. It's not just bad advice; these posts are outright traps. They trick users into opening PowerShell as an administrator and running a specific command. This isn't a hidden attack; it relies on direct user interaction, preying on the trust within gaming communities.

The attackers' goal is to install XMRig cryptominers, which don't steal your data directly but secretly hijack your CPU to mine cryptocurrency for them. This results in degraded gaming performance, system slowdowns, and even higher electricity bills for you.

How a Simple PowerShell Command Establishes Persistence

Let's break down what happens once that PowerShell command is run:

First, the script attempts to appear legitimate. It identifies itself as "msf utility \ PC Opt" and displays fake progress bars. It pretends to clean temporary files, flush DNS, update drivers, and even scan for malware. These pauses create the illusion of genuine system work.

While "optimizing," the script performs its true function:

1. It first verifies administrator privileges. Without them, the script exits. This check is crucial for subsequent actions.
2. It creates a non-standard directory: C:\Windows\Background. This location is designed to blend in, avoiding immediate suspicion.
3. A key defense evasion technique is then employed: the script adds C:\Windows\Background as an exclusion to Microsoft Defender. This ensures Defender, the primary built-in defense, will ignore everything in that folder.
4. It attempts to stop any existing scheduled tasks named XMRig-[computer name] and terminate xmrig or system processes from its installation directory. It also deletes old XMRig configuration files. This suggests the attackers want to ensure their specific miner runs without conflict, or perhaps to clean up previous infections.
5. It creates a temporary outbound Windows Firewall rule. This rule permits connections to msfconfig[.]icu over TCP port 443, allowing the miner payload to be downloaded.
6. The XMRig miner payload, disguised as system.txt, downloads from https://msfconfig[.]icu:443/tmp/system.txt. It saves to a temporary file, validates as an executable, then moves to C:\Windows\Background\system.exe.
7. The final, and most resilient, step is the scheduled task. It creates a new task, 'XMRig-[computer name],' set to launch C:\Windows\Background\system.exe with SYSTEM privileges every time Windows starts. This guarantees the miner reactivates, even if you manually kill the process or reboot your system.

The Impact: Why Gamers Resort to OS Reinstallation

What does this mean for you? Your gaming PC essentially turns into an unauthorized mining rig. Users frequently report high CPU usage, degraded gaming performance, and overall system sluggishness.

The persistence mechanism is particularly effective. Because the miner resides in a Defender exclusion, standard antivirus scans often fail to detect it. Even if a user manually terminates the process, the scheduled task ensures it restarts with SYSTEM privileges upon reboot. This explains why many users report frustration online, noting antivirus failures or the miner reappearing. The malware is engineered to resist conventional removal methods.

But it's not just about individual systems; this incident also chips away at trust in online communities. When a "fix" from a forum can compromise your PC, it naturally makes people less willing to collaborate and help each other.

The Response: Mitigations and the Challenge of Social Engineering

If you're an individual user, here's what you need to do to fix it:

Start by running a full antivirus scan. While the Defender exclusion might prevent detection of the miner itself, it could identify other related threats. If the antivirus fails, you'll need to manually remediate. This means stopping and removing the scheduled task named XMRig-[computer name] via Task Scheduler. Then, remove the Microsoft Defender exclusion for C:\Windows\Background to allow proper scanning. Finally, delete the C:\Windows\Background folder and its contents.

Honestly, a complete operating system reinstallation is often the most reliable solution. Because the miner operates with SYSTEM-level privileges and messes with core security settings, there's always a risk of other hidden malicious activity. A fresh OS installation gives you the highest confidence that everything is truly clean.

At a platform level, services like Steam face an ongoing challenge against these social engineering attacks. Aggressive identification and banning of accounts posting malicious content are essential. For users, the core lesson is straightforward: never execute PowerShell commands provided by unknown users in discussion forums. If a "fix" demands disabling security features or running unfamiliar commands, it is almost certainly a malicious trap.

This is not a complex zero-day exploit. It relies on basic social engineering combined with effective, yet simple, persistence mechanisms. Its success stems from preying on users' eagerness for quick fixes and their trust in community advice. To fight this, we need to understand how it works and always be skeptical of unsolicited technical help.