Hackers Use Steam Forums to Push XMRig Miner

The Steam ClickFix campaign is abusing Steam discussion forums to trick users into installing the XMRig cryptocurrency miner through malicious PowerShell commands.

According to BleepingComputer, attackers post replies that appear to solve game crashes, missing inventory items, and other technical problems. The instructions tell users to open PowerShell with administrator privileges and run a supplied command.

Steam forum replies deliver the XMRig miner

The PowerShell commands secretly download and launch XMRig, a legitimate cryptocurrency mining program commonly abused by threat actors.

The campaign uses a social engineering technique known as ClickFix. Instead of exploiting a Steam or Windows vulnerability, attackers convince users to manually execute the malicious code.

Running the command directly can also help the malware avoid some security protections because the activity appears to come from an authorized user.

Fake Windows optimization tool hides the infection

The malicious script presents itself as a Windows optimization tool called “msf utility \ PC Opt.”

It claims to perform several maintenance tasks, including cleaning temporary files, updating device drivers, scanning for malware, repairing Windows, and improving system performance.

Most of these actions are fake. The script displays progress messages to make the tool appear legitimate while installing the cryptocurrency miner in the background.

Script disables protections and creates persistence

The script requires administrator privileges and creates the following directory:

C:\Windows\Background

It then adds that folder to Microsoft Defender’s exclusion list, preventing Defender from scanning files stored inside it.

The XMRig miner is saved as system.exe. The malware also creates a scheduled task with a name beginning with XMRig-.

This task launches the miner with SYSTEM privileges whenever Windows starts, allowing it to remain active after a restart.

Malware creates firewall rules for network access

The script creates a Windows Firewall rule that allows communication with the server used to download the malicious files.

It also searches for and removes older mining processes, configuration files, and related components before installing the latest payload.

Attackers may use this process to replace an earlier infection or remove competing cryptocurrency miners already running on the device.

How to detect the Steam ClickFix infection

Users should check their systems for the following signs:

• A C:\Windows\Background folder
• A Microsoft Defender exclusion for that directory
• A scheduled task with a name beginning with XMRig-
• An XMRig or system.exe process using high CPU resources
• Unexpected firewall rules linked to suspicious servers

High and continuous CPU usage may cause reduced game performance, overheating, increased power consumption, and faster hardware wear.

What affected users should do

Users should never run PowerShell commands posted by unknown people in Steam discussions or other online forums.

Troubleshooting instructions that require administrator privileges should receive additional scrutiny, especially when they involve copying and pasting commands without explaining what they do.

Anyone who executed the malicious command should immediately run a full scan with a trusted security tool. Users should also remove suspicious Microsoft Defender exclusions, firewall rules, scheduled tasks, files, and running processes.

Reinstalling Windows may offer the safest recovery option when users cannot determine the full extent of the compromise.

In other security news, hackers are hijacking hotel Wi-Fi networks to steal Microsoft 365 accounts, while the Chaos ransomware group is using msaRAT to hide malicious traffic inside Chrome and Microsoft Edge.