Steam Forums Hit by ClickFix Malware

A campaign targeting the Steam community is leveraging social engineering to compromise user systems. Attackers are masquerading as helpful contributors on discussion forums, providing deceptive commands designed to resolve common gaming errors while secretly installing unauthorized software.

The Mechanics of ClickFix

This tactic, known as ClickFix, relies on the trust users place in community-driven troubleshooting. Threat actors monitor posts regarding game crashes or lost inventory, interjecting with technical solutions that require the victim to open PowerShell with administrative privileges. By presenting these instructions as legitimate fixes, the attackers bypass typical security barriers that might otherwise flag automated malicious code execution.

Deceptive Optimization Scripts

The malicious script distributed in this campaign masks its true intentions under the guise of a Windows utility called "msf utility \ PC Opt." To appear authentic, the program displays a sequence of fake progress messages, performing simulated maintenance tasks such as driver updates, disk checks, and DNS flushing. The script is programmed to pause for between 1.5 and 8 seconds during these steps to mimic the duration of actual system processes.

Cryptomining and Persistence

Once the script gains elevated access, it initiates a series of stealthy modifications to the system environment. The malware creates a directory at C:\Windows\Background and forces an exclusion within Microsoft Defender to prevent the security software from scanning the folder. It then establishes a connection to a remote server, downloading the XMRig miner payload to the device. To ensure long-term operation, the malware creates a scheduled task that triggers the miner with system-level permissions every time the computer boots.

Protecting Your System

Users who suspect they may have executed these commands should inspect their systems for the specific indicators identified in the campaign. This includes verifying the existence of the C:\Windows\Background directory, checking for specific Microsoft Defender exclusions, and searching for any scheduled tasks labeled with the prefix XMRig-. Because the script runs with high-level privileges, analysts suggest that manual removal may not be sufficient to ensure the system is entirely clean.

The complexity of these attacks means that the risk extends beyond simple cryptomining. If a device shows signs of infection, the most thorough path to remediation involves a complete reinstallation of the operating system. Because the payload operates in the background, there is no definitive way to verify if additional secondary malicious actions were performed during the initial compromise.