Steam forum ClickFix attacks infect gamers with XMRig cryptominers

# The Helpful Stranger in Your Steam Thread Is Mining Your CPU

When your game crashes and someone in the Steam forums offers a fix, you want to believe them. That's the exploit.

Since at least mid-July 2026, threat actors have been creating throwaway Steam accounts and patrolling discussion threads — game crashes, lost inventory, stuttering framerates — then replying with authoritative-sounding PowerShell "fixes." Run this as administrator, they say. It'll clear your cache, update your drivers, repair your Windows image. Instead, it quietly installs XMRig, a Monero cryptominer, and buries it deep enough in your system that it survives reboots and antivirus scans.

This is ClickFix. And it's getting very good at reading the room.

## Why Gamers Are the Right Target

ClickFix as a tactic has been running for two years now — it showed up in fake CAPTCHA prompts, phony Microsoft support pages, and counterfeit browser error dialogs. What's changed is the targeting. Gaming communities have a specific culture that makes them particularly vulnerable to this kind of attack: members share fixes obsessively. Forum threads about crashing games or corrupted saves routinely fill with PowerShell one-liners, registry edits, and launch parameter tweaks. Running commands you found online is normalized behavior here in a way it isn't in most other communities.

The attackers know this. They're not spraying generic lures — they're responding *directly to posts* about specific problems, which means victims arrive at the malicious command already frustrated, already looking for a solution, and already primed to trust someone who seems to have the answer.

Gaming rigs are also worth targeting. Mid-to-high-end consumer machines with fast multi-core CPUs — the kind needed to run modern titles at high settings — are exactly what a Monero miner wants. XMRig uses CPU cycles, not GPU, so it doesn't hammer framerates in a way the victim would immediately notice. A miner running at 50% CPU load in the background might shave a few frames, but in a forum thread about a crashing game, nobody's thinking "wait, is something mining on my machine?"

## What the Script Actually Does

The PowerShell payload dresses itself up as "msf utility \ PC Opt," a Windows optimization tool. It displays a cascade of fake progress messages — cleaning temp files, flushing DNS, scanning for malware — with randomized pauses between one and eight seconds to sell the illusion of real work happening. It's theater. Most of those functions do nothing except print text to the console.

The real action happens in a function pointedly named Advanced-Optimization. Here's the sequence:

That cleanup step is worth sitting with for a moment.

The script is actively looking for a previous installation of itself — or possibly a *competitor's* miner — before deploying. This is territorial behavior. Cryptomining operations increasingly fight each other for the same infected machines, and this script appears designed to evict whatever's there before moving in. Whether that's removing a prior version of the same campaign or squatting on machines already infected by a different actor is unclear, but either way it implies an organized operation, not a one-off experiment.

After cleanup, the script reaches out to msfconfig[.]icu over port 443 to download the XMRig payload, verifies it's a valid executable, drops it as C:\Windows\Background\system.exe, and creates a scheduled task running with SYSTEM privileges to ensure it restarts every time Windows boots.

SYSTEM-level persistence for a cryptominer is not standard. It suggests the authors expect some removal attempts and want the miner to survive them.

## The Defense Problem With ClickFix

The reason ClickFix attacks keep working — and keep spreading to new platforms — is structural. Security tooling is built around detecting and blocking *automatic* code execution. Endpoint detection, script-block logging, AMSI, Defender's behavioral analysis — all of it is tuned for malware that runs without user involvement. When a human being opens PowerShell as an administrator and pastes in a command themselves, they've manually bypassed most of those controls. The user is the delivery mechanism.

This is hard to solve with software. It requires either better community moderation (Steam should be treating account-age-gated forum posting as a fraud signal, not just a spam signal) or better user awareness — which, to be honest, has a poor track record as a defensive strategy in any context.

---

## HackWire Analysis

The Steam campaign is not an outlier — it's a symptom of where ClickFix is going. The tactic started in 2024 targeting corporate help-desk scenarios, evolved through 2025 to hit healthcare portals and government services, and is now actively adapting to community-specific trust models. Every platform where people help each other troubleshoot is a viable attack surface.

What makes the Steam variant particularly instructive is the eviction logic. If this were a simple script-kiddie operation, there'd be no cleanup of competing miners. The fact that it's there suggests the people behind this campaign are running cryptomining as a *business* — one with territorial concerns about machine share, with infrastructure (msfconfig[.]icu) that isn't opportunistically grabbed but purpose-registered, and with enough operational sophistication to write convincing theater into their PowerShell scripts.

The Defender exclusion path (C:\Windows\Background) is worth flagging specifically. Threat hunters on Windows environments should treat any exclusion path that doesn't map to a documented enterprise application as an immediate investigation priority. This path has no legitimate business justification. If you see it, something added it for a reason.

For Steam specifically: Valve has a moderation problem here that goes beyond spam. Forum posts by accounts younger than 30 days that include PowerShell commands should trigger an automatic hold. That's not a sophisticated filter — it's a straightforward signal that maps almost perfectly to this attack pattern.

More broadly, organizations with gamers on their fleet — which, in a work-from-home era, includes most organizations — should assume that home machines running Steam are a real attack vector. XMRig running at SYSTEM privileges on a personal machine that also connects to corporate VPN is a security problem that doesn't stay neatly in the personal category.

The campaign is ongoing. If you ran a "fix" from a Steam forum in the past few weeks and felt uneasy about it, check your scheduled tasks for anything named XMRig- followed by your computer name, and look for C:\Windows\Background\system.exe. If it's there, wipe and reinstall — a SYSTEM-privileged miner has had enough access to your machine that you cannot trust a cleanup tool to catch everything it may have done.

— HackWire Editorial

---

## Related Coverage