Steam's discussion forums — the largest game distribution platform in the world — are being weaponized in a malicious campaign that infects gamers with the XMRig cryptocurrency miner. Attackers create random accounts and post messages that appear to offer helpful fixes for common problems: games crashing, lost inventory items, performance errors. But instead of helping, the requested "fix" is actually the execution of a PowerShell command that downloads and installs the miner.
The attack mechanism: users infect themselves
The technique is known as ClickFix, a form of social engineering in which the victim is tricked into manually executing a malicious command. Instead of a CAPTCHA verification button or a legitimate error window, the page displays instructions for the user to open PowerShell as administrator and paste a command. By doing so, the gamer effectively infects their own machine.
According to a BleepingComputer report published on July 25, 2026, the PowerShell script distributed in the campaign masquerades as a Windows optimization utility called "msf utility \ PC Opt." When executed, it displays fake progress messages claiming to clean temporary files, flush the DNS cache, update drivers, check the disk, disable unnecessary startup items, scan for malware, and repair the system image. Most of these functions do nothing — they simply pause for a random period between 1.5 and 8 seconds to appear legitimate.
The actual malicious activity is hidden in a function called 'Advanced-Optimization.' It first disables TLS certificate validation and checks that it is running with administrator privileges. If not, it displays an error and exits. With elevated privileges, the script creates the C:\Windows\Background directory, adds this folder as an exclusion for Microsoft Defender scanning, and stops any existing scheduled task named 'XMRig-[computer name].'
The miner is downloaded from msfconfig[.]icu on port 443 and saved as C:\Windows\Background\system.exe. To ensure persistence, the script creates a new scheduled task named "XMRig-[computer name]" that runs the miner with SYSTEM privileges.
Why gamers are prime targets
Gamers are particularly attractive targets for cryptocurrency mining campaigns because their computers typically feature high-performance graphics cards (GPUs) — exactly the type of hardware XMRig uses to mine Monero. A gaming computer can generate significant revenue for attackers while the owner is playing or even when the computer is idle, without the victim noticing — the miner is configured to use only available resources without fully compromising performance.
The campaign is not limited to Windows. XMRig is cross-platform, with versions for Linux and macOS, and attackers have adapted their strategies for each operating system.
Broader context: the rise of ClickFix
The Steam attack is just the tip of the iceberg. In May 2026, Malwarebytes documented a massive campaign that compromised over 700 legitimate websites — including universities and technology companies — through a vulnerability in the Ghost Content Management System (CVE-2024-45228). Attackers injected scripts that displayed a fake Cloudflare or CAPTCHA challenge, instructing visitors to copy and paste commands into PowerShell.
"Without any authentication, an attacker can directly read the database contents through this vulnerability, including the Admin API Key used to call the Ghost Admin API," the researchers wrote. Approximately 700 sites running vulnerable Ghost versions (3.24.0 through 6.19.0) were compromised.
What makes ClickFix particularly dangerous is that it bypasses traditional security protections. Because the user executes the command manually, firewalls, antivirus software, and intrusion detection systems do not see an automated malicious execution — they see a legitimate user performing an action. And the instructions are framed as harmless technical steps: "verify you're human," "fix your connection," or "continue to the site."
What to watch
For Steam users, the recommendation is clear: never execute PowerShell commands provided by strangers in discussion forums, even if they appear to be legitimate solutions for a problem you are experiencing. Those who have already executed the command should check for the C:\Windows\Background directory, suspicious Microsoft Defender exclusions, and scheduled tasks beginning with 'XMRig-'.
The Steam campaign shows how attackers are evolving their social engineering tactics, leveraging the trust users place in established platforms and the appearance of legitimacy in discussion forums. Combined with the mass compromise of websites via Ghost CMS, it is clear that ClickFix is not a passing fad — it is a long-term structural trend in the cyber threat landscape.
Sources: BleepingComputer, 0x0 Blog, Malwarebytes
