In a sophisticated social engineering campaign currently targeting the Steam community, threat actors are abusing the platform’s discussion forums to trick gamers into downloading and executing cryptocurrency miners. The attack, known as ClickFix, preys on users seeking technical support by posing as a helpful solution to common gaming issues, such as game crashes, lost inventory items, or general system performance problems. Instead of resolving these issues, the provided instructions instruct the user to run a malicious PowerShell command that silently deploys the XMRig cryptominer, hijacking the computer’s processing power to mine Monero for the attackers.
BleepingComputer received reports of this campaign from a reader, who detailed how threat actors create seemingly random Steam accounts to post replies in technical support threads. These replies appear to offer legitimate fixes, often claiming to be “Windows optimization utilities” or direct solutions for specific game errors. The user is instructed to copy and paste a PowerShell command into an elevated (administrator) command prompt. Executing this command triggers a multi-stage infection process that culminates in the silent installation of XMRig.
How the Steam forum ClickFix attack works
The social engineering tactic at the heart of this campaign is known as ClickFix. This approach relies on presenting users with a fake error message, a bogus verification prompt, or, as in this case, what appears to be a legitimate troubleshooting instruction. The attacker’s goal is to trick the victim into manually executing a malicious command, bypassing many automated security defenses that would normally block a script or executable from running. Since the victim initiates the action themselves, tools like Windows Defender or endpoint detection and response (EDR) systems may not flag it as suspicious activity, allowing the attack to proceed unimpeded.
The victim first encounters a post on a Steam forum thread describing a critical issue—an inability to launch a game, a lost item, or a system error. A malicious responder then chimes in with a solution, often using technical jargon to appear credible. The solution invariably involves opening PowerShell as an administrator and pasting in a specific command. The promise of a quick, free fix from a fellow user is a powerful lure for desperate gamers.
Analyzing the “msf utility \ PC Opt” PowerShell script
The PowerShell script distributed in this campaign masquerades as a benign Windows optimization tool called “msf utility \ PC Opt.” When executed, it begins by displaying a series of seemingly legitimate maintenance messages. These messages claim the tool is performing a comprehensive cleanup: cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk for errors, disabling unnecessary startup items, scanning for malware, repairing the Windows image, and running the System File Checker (SFC).
Our analysis reveals that these functions are largely a facade. The script does not actually perform these complex tasks. Instead, it displays fake progress messages and introduces random, short pauses—between 1.5 and 8 seconds—to simulate work and give the impression of a legitimate utility. This is a classic trick: create a plausible user experience so the victim trusts the tool long enough for the real payload to be delivered.
The true malicious behavior is hidden within a function named Advanced-Optimizationcodecodecodecodecode. This function is the core of the attack. It first disables TLS certificate validation, a critical security measure that allows the script to connect to a malicious command-and-control server without raising certificate errors. It then verifies that the script is running with administrator privileges. If it is not, it displays an error message demanding administrative rights and exits. This step is crucial because the miner requires elevated access to install itself, persist across reboots, and evade detection.
Behind the curtain: The miner’s installation and persistence
Once the script has administrator privileges, it begins its destructive work. It creates a new directory, C:\Windows\Backgroundcodecodecodecodecode, which will serve as the miner’s installation folder. To ensure the miner goes undetected by antivirus scans, the script adds this entire directory as an exclusion path in Microsoft Defender. This means Defender will not scan or monitor any files or processes within that folder, making the miner effectively invisible to the built-in security tool.
The script also performs a cleanup operation. It attempts to stop an existing scheduled task named XMRig-[computer name]codecodecodecodecode and terminates any running processes named xmrigcodecodecodecodecode or systemcodecodecodecodecode that are located in the C:\Windows\Backgroundcodecodecodecodecode directory. It also deletes existing configuration files (C:\Windows\Background\config.jsoncodecodecodecodecode). It is currently unclear whether this cleanup is intended to remove remnants of a previous miner infection from the same campaign or to eliminate a competing miner already present on the victim’s machine. This behavior suggests the attackers want a clean, exclusive environment for their own software.
Next, the malware creates a temporary outbound Windows Firewall rule. This rule allows the compromised computer to make outbound TCP connections over port 443 to a specific domain: msfconfig[.]icucodecodecodecodecode. The attacker then downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txtcodecodecodecodecode into a randomly named temporary file. Before installing it, the script validates that the downloaded file is not empty and is a valid Windows executable. This quality check ensures the infection process is not broken by a corrupted download. If valid, the file is moved to C:\Windows\Background\system.execodecodecodecodecode.
To ensure the miner relaunches every time Windows starts, the script creates a new scheduled task, again named XMRig-[computer name]codecodecodecodecode. This task is configured to run the system.execodecodecodecodecode executable with the highest level of system privileges (SYSTEM), ensuring it operates even before a user logs in.
What are the indicators of compromise for this XMRig miner?
For users who suspect they may have been targeted, there are several key signs to look for that indicate a system has been compromised by this specific campaign. The most critical indicators are the presence of the C:\Windows\Backgroundcodecodecodecodecode directory, a Microsoft Defender exclusion rule that includes that path, and a scheduled task with a name beginning with XMRig-codecodecodecodecode. These three elements are the hallmark of this particular infection.
Another strong indicator is an unusual spike in CPU usage, especially when the computer is idle. Cryptominers are resource-intensive, and the XMRig process will consume a significant portion of the CPU cycles, causing the computer to run slowly, fans to spin louder, and battery life to drain faster. Additionally, the outbound connection to msfconfig[.]icucodecodecodecodecode over TCP port 443 may be visible in network logs, although the use of standard HTTPS port 443 is designed to blend in with normal web traffic.
If any of these signs are detected, the immediate step is to run a full scan with a reputable antivirus or anti-malware program. However, because the attacker has added an exclusion to Microsoft Defender, it may not detect the miner. In such cases, manual remediation is necessary. Users should stop and delete the XMRig-[computer name]codecodecodecodecode scheduled task using the Task Scheduler, remove the Microsoft Defender exclusion for C:\Windows\Backgroundcodecodecodecodecode, and then delete the folder and its contents. For users concerned about additional hidden payloads, a complete reinstallation of the operating system is the most secure option.
The broader context of ClickFix and gaming community threats
This campaign is a clear evolution of the ClickFix social engineering technique, which has gained traction in recent years. Unlike traditional phishing that lures users to a fake website, ClickFix attacks bypass the browser entirely and manipulate the user directly at the operating system level. The use of PowerShell commands, in particular, is a favored technique because it provides the attacker with immense power and flexibility while leaving little forensic trace on the system.
The gaming community is a particularly attractive target for these attacks. Gamers often spend long hours on their computers, and the value of a high-performance PC makes it a prime candidate for cryptocurrency mining. Furthermore, the culture of seeking help in online forums makes users more trusting of strangers offering solutions. The platform’s large user base and the high-performance nature of gaming hardware create a perfect storm for this type of exploitation.
This incident also underscores a fundamental security principle: never run a script or command provided by an unknown or untrusted source, especially one that requires administrative privileges. The promise of a quick fix is a common psychological trigger in social engineering. The attackers exploit the user’s desire for a simple solution to a complex problem, leveraging trust and technical authority to bypass critical security controls. For the average user, the safest course of action is to ignore such offers and rely on official support channels, trusted antivirus solutions, and well-known system utilities from reputable developers.
