Steam ClickFix Posts Push XMRig Miner Through PowerShell

Steam discussion replies are being abused in a ClickFix-style malware campaign that tells players to run a fake PowerShell “fix” and then installs an XMRig cryptominer on Windows systems, according to BleepingComputer’s July 25 report.^[1] The posts are written to look like helpful answers for game crashes, missing inventory, or PC performance problems, but the command chain quietly moves the victim from troubleshooting into malware execution.

The important detail is not just the Steam angle. This is another reminder that ClickFix attacks work because they make the user perform the risky step manually. In earlier campaigns, fake CAPTCHA pages and browser prompts used the same trick; howtofix.guide recently covered ACR Stealer abusing ClickFix lures to target browser tokens. In this Steam case, the lure is a supposed Windows optimization utility, and the payload is a miner instead of an infostealer.

BleepingComputer says the script presents itself as “msf utility PC Opt” and displays fake maintenance messages for tasks such as temporary-file cleanup, DNS flushing, driver updates, disk checks, malware scanning, and Windows image repair.^[1] Those messages are meant to buy trust and time. The malicious portion is hidden in an “Advanced-Optimization” function that checks for administrator privileges, disables TLS certificate validation, and prepares the system for a persistent miner install.

What Steam Users Should Check Now

Users who copied a PowerShell command from a Steam forum reply should treat the system as potentially compromised, especially if the command asked for administrator rights. MITRE classifies PowerShell abuse under command-and-scripting execution because attackers can use it to download payloads, change system settings, and run code directly on Windows.^[2] In practical terms, the red flag is simple: a stranger in a forum should not be telling you to run administrative PowerShell as a “fix.”

The Steam campaign described by BleepingComputer creates C:WindowsBackground, adds that path as a Microsoft Defender exclusion, downloads the miner from the defanged host msfconfig[.]icu, saves it as system.exe, and creates a scheduled task named XMRig-[computer name] so the miner starts with SYSTEM privileges.^[1] Microsoft’s own Defender documentation explains that exclusions can prevent specified files, folders, or processes from being scanned, which is why an unexpected exclusion is a serious sign of tampering.^[3]

If you ran one of these commands, check for three artifacts first: the C:WindowsBackground folder, a Microsoft Defender exclusion for that same path, and a scheduled task whose name begins with XMRig-. Also review recent PowerShell history, Windows Security protection history, and unusually high CPU usage after reboot. XMRig is legitimate open-source mining software, but it is commonly repurposed by criminals to mine Monero on someone else’s hardware.^[4] The site has seen the same pattern before in XMRig miners hidden in popular game cheats.

Do not try to “repair” the same system by running another forum command. Disconnect from the network if the machine is still behaving suspiciously, remove the scheduled task and Defender exclusion only if you are confident you can do it safely, and run a full malware scan from trusted security software. Because the script executes with elevated privileges and retrieves a payload from a remote server, a clean reinstall may be the safer path for systems used for banking, work accounts, game inventories with market value, or cryptocurrency wallets.

The bigger lesson is that ClickFix is no longer limited to fake browser errors or CAPTCHA pages. Attackers are now placing the same social-engineering pattern inside support conversations where the victim is already frustrated and looking for a quick fix. Treat PowerShell, Command Prompt, Terminal, registry edits, and downloaded “optimization” utilities as high-risk instructions unless they come from an official vendor source. For another example of miners spreading through search and fake help content, see how GPU mining malware used SEO poisoning and AI-chatbot lures.

References

1. Lawrence Abrams, BleepingComputer, “Steam forum ClickFix attacks infect gamers with XMRig cryptominers,” July 25, 2026.
2. MITRE ATT&CK, “Command and Scripting Interpreter: PowerShell (T1059.001).”
3. Microsoft Learn, “Configure and validate exclusions for Microsoft Defender Antivirus scans.”
4. Check Point, “XMRig Malware.”