A ClickFix social engineering campaign is spreading through Steam’s discussion forums, tricking gamers into infecting their own machines with cryptomining malware. BleepingComputer reports that threat actors are creating throwaway Steam accounts to reply to legitimate user posts about game crashes, lost inventory items, and other technical issues, offering what looks like a helpful fix.
The replies instruct victims to open PowerShell as an administrator and run a supplied command. Rather than resolving anything, the command downloads and launches an XMRig cryptominer executable in the background.
Fake optimization tool hides the real payload
The PowerShell script poses as a Windows optimization utility called “msf utility \ PC Opt.” It displays a convincing series of maintenance messages, claiming to clean temporary files, flush the DNS cache, update drivers, check the disk, disable startup items, scan for malware, and run System File Checker. Most of these steps do nothing but pause for a randomized 1.5 to 8 seconds to simulate real work.
The actual malicious logic sits in a function called ‘Advanced-Optimization.’ It disables TLS certificate validation and confirms it is running with administrator privileges before proceeding. It then creates a ‘C:\Windows\Background’ directory and adds it as a Microsoft Defender scan exclusion. The script also attempts to kill any existing ‘XMRig-[computer name]’ scheduled task and terminate running processes named ‘xmrig’ or ‘system,’ along with deleting any prior config.json file, cleanup that may target leftovers from earlier infections or competing miners.
A temporary outbound Windows Firewall rule is then created to allow traffic to ‘msfconfig[.]icu’ over TCP port 443, from which the script downloads the XMRig payload and validates it as a legitimate executable before installing it as C:\Windows\Background\system.exe. Persistence is established via a scheduled task named ‘XMRig-[computer name]’ that runs the miner with SYSTEM privileges on every startup.
What to check for
Users who ran such a command should look for the ‘C:\Windows\Background’ directory, a matching Defender exclusion, and a scheduled task starting with ‘XMRig-.’ If found, run an antivirus scan immediately. If nothing is detected, manually remove the scheduled task, the Defender exclusion, and the folder contents. Because the payload could have performed additional undetected actions, a full OS reinstall may be the safer option.
The core lesson remains unchanged: never run PowerShell commands posted by strangers in forums, even when framed as a fix for a problem you’re actively experiencing.