Steam discussion forums are being abused in ClickFix attacks that lure users with fake fixes for game and Windows problems, but the commands actually install an XMRig cryptominer. The campaign uses fake Steam accounts, a disguised “msf utility PC Opt” script, and persistence through a scheduled task and Microsoft Defender exclusions to keep the miner running. #Steam #ClickFix #XMRig #msfconfigicu
Keypoints
- Attackers create random Steam accounts to post fake troubleshooting advice.
- Victims are told to run PowerShell commands as administrator.
- The malicious script downloads and launches the XMRig miner.
- The payload hides behind a fake Windows optimization tool called “msf utility PC Opt.”
- The script adds Defender exclusions, creates persistence, and uses a scheduled task named “XMRig-[computer name].”