Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.
BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people's posts about games crashing, lost inventory items, and other technical issues.
The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.
These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.
Although ClickFix attacks require interaction from the victim, they are effective because they present users with what appears to be both a legitimate solution for a problem they are having.
Since the victim manually launches the command, the attack can also bypass some security protections that would otherwise automatically block executed malicious code.
Fake Windows optimization installs malware
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named "msf utility \ PC Opt."
When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker.
However, most of these functions do not perform the tasks they claim. Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate.
The actual malicious activity is hidden in a function named 'Advanced-Optimization', which first disables TLS certificate validation and checks that it is running with administrator privileges. If it is not, the script displays an error stating that administrator rights are required and exits.
Once running with elevated privileges, the script creates the 'C:\Windows\Background' directory and adds it as an exclusion to Microsoft Defender's scanning functions.
It also attempts to stop an existing scheduled task named 'XMRig-[computer name]' and terminates matching processes named 'xmrig' or 'system' that are running from the installation directory. It also attempts to delete any XMRig configuration files stored as C:\Windows\Background\config.json.
It is unclear whether this cleanup is intended to remove leftovers from an earlier install of the same malware or another miner already present on the device.
The malware then creates a temporary outbound Windows Firewall rule allowing connections to 'msfconfig[.]icu
' over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt
into a randomly named temporary file.
Before installing it, the script verifies that the downloaded file is not empty and is a valid executable. If so, it moves the file to C:\Windows\Background\system.exe
.
So it launches every time Windows starts, it will create a new scheduled task named "XMRig-[computer name]
," that launches the system.exe executable with SYSTEM privileges.
As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing.
Those who executed the command should check for the 'C:\Windows\Background' directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with 'XMRig-'.
If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds.
If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents.
Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Comments
HusamA - 12 hours ago
Where can we find a sample for this?
fromFirefoxToVivaldi - 2 hours ago
What was MS smoking when they set the "download a remote script" command to "irm" and "run a script" to "iex" and let one pipe directly into another?
If this was at least and "get" command and a "run" command more people would have a chance to notice what exactly it it someone on the internet is telling them to do. What's worse, the fact that you can skip https at the beginning lets the attackers make the command look like a windows applet.
Microsoft could do a lot to make those kinds of attack harder.
EndangeredPootisBird - 1 hour ago
They have had years to fix things, yet all they've done during that time is add more privacy-invasive bloat.