Attackers are exploiting Steam’s community forums with a new social engineering campaign that tricks players into running malicious PowerShell commands. These commands, disguised as fixes for common game problems, secretly install the XMRig cryptocurrency miner on victims’ Windows PCs. The attack, reported by BleepingComputer and SC Media, uses a technique known as ClickFix to bypass security warnings by having the user manually execute the malicious code.

What’s Happening on Steam Right Now

The campaign works like this: Threat actors create or compromise Steam accounts and post replies to discussion threads where users are asking for help with crashes, missing inventory, or performance issues. The reply offers a seemingly legitimate solution—a PowerShell command to run as an administrator that claims to fix the problem. But behind the scenes, the command deploys a cryptominer.

According to BleepingComputer’s analysis, the PowerShell script begins by displaying a bogus “PC optimization” tool called “msf utility / PC Opt.” It shows fake progress messages for disk cleanup, DNS flushing, driver updates, and malware scanning, all while quietly disabling security settings and downloading the XMRig miner. The script disables TLS certificate validation, creates a hidden folder at C:\Windows\Background, adds that path to Microsoft Defender’s exclusion list, and then fetches the miner executable from the remote server msfconfig[.]icu. Once downloaded as system.exe, it sets up a scheduled task named “XMRig-[computer name]” to run the miner at every startup with SYSTEM privileges.

Because the user voluntarily opens an elevated PowerShell window and pastes the command, the attack sidesteps many automated protections. The fake maintenance output also creates a false sense of legitimacy, making it less likely that the victim will check Task Manager or investigate further.

Who’s at Risk

The scam primarily targets gamers looking for quick fixes on Steam’s discussion forums. However, the threat extends to anyone who may copy a PowerShell command from an untrusted source—whether from Discord, Reddit, YouTube comments, or private messages. The campaign does not exploit a software vulnerability; it exploits human trust and a sense of urgency.

For home users, the miner can cause severe performance degradation: high CPU or GPU usage, overheating, loud fans, stuttering in games, and noticeably higher electricity bills. But performance is only the most obvious symptom. Because the script ran with administrative privileges, it could have stolen saved passwords, browser data, or other sensitive files. The attackers could also change the payload at any time, so a machine infected today might tomorrow receive ransomware or a keylogger.

IT administrators managing Windows environments should be aware that this attack vector can easily cross over into corporate networks if an employee runs such a command on a work device. The presence of a Defender exclusion folder and a SYSTEM-level scheduled task indicates a deep compromise that may require reimaging the device.

How the Scam Slips Past Defenses

ClickFix attacks exploit the fact that users can authorize actions that security software would normally flag or block. When a person manually launches an elevated PowerShell window and runs a command, Windows treats it as an intentional administrative action. This makes it harder for endpoint protection to intervene, especially when the command does not immediately drop a known malicious executable.

The additional steps—disabling certificate validation and adding a Defender exclusion—are particularly insidious. Certificate validation is a fundamental security check; turning it off means the script can communicate with any server without verifying its identity. Adding a folder to Defender’s exclusion list prevents the antivirus from scanning files in that directory, effectively giving the miner a safe hiding spot. Microsoft’s own documentation warns that exclusions can reduce protection, yet the attackers turn this feature into a deliberate evasion technique.

Steam’s forum culture also works in the attackers’ favor. Players are used to helping each other out, and a reply that appears to solve a specific issue feels more credible than a random email. The malicious posts often use technical jargon and a confident tone, making them blend in with legitimate support replies.

Removing the Infection

If you suspect you’ve run a suspicious PowerShell command from a Steam forum, take these steps immediately:

  1. Disconnect from the internet to stop any ongoing data exfiltration or mining.
  2. Look for known indicators of compromise (IoCs):
    - Folder: C:\Windows\Background\
    - File: C:\Windows\Background\system.exe
    - A Microsoft Defender path exclusion for C:\Windows\Background
    - A scheduled task with a name like XMRig-[computer name]
    - Connections to msfconfig[.]icu
  3. Run a full antivirus scan after updating your security software. A quick scan is not enough; because the miner is hidden in an excluded folder, a full scan is necessary to detect it.
  4. Remove the scheduled task with PowerShell (document it first if you need evidence):
    powershell Get-ScheduledTask | Where-Object {$_.TaskName -like 'XMRig-*'} | Unregister-ScheduledTask -Confirm:$false
  5. Remove the Defender exclusion:
    powershell Remove-MpPreference -ExclusionPath 'C:\Windows\Background'
  6. Delete the malicious folder and files after the above steps:
    powershell Remove-Item 'C:\Windows\Background' -Recurse -Force
  7. Restart and rescan to ensure nothing reappears.
  8. Change all important passwords —especially your Steam, email, and Microsoft accounts—from a clean device.
  9. Consider a full Windows reinstallation if multiple IoCs were present, if the same artifacts keep returning, or if you handle sensitive data on that PC. BleepingComputer emphasizes that a reinstall may be the safest option because the initial script had full administrative access and could have performed additional unreported actions.

Staying Safe from Fake Fixes

The strongest defense is a simple rule: never paste a command into PowerShell, Command Prompt, or Run just because a forum post says it will help. This applies to Steam, Reddit, Discord, YouTube comments, and anywhere else anonymous users can post.

Legitimate support will never ask you to:
- Open PowerShell as an administrator and run an opaque, long command.
- Disable your antivirus or add folder exclusions.
- Ignore certificate warnings, SmartScreen, or User Account Control prompts.

If you need a fix, get it from the official game developer’s website, Steam Support, or a verified publisher moderator. Even then, try to understand what the command does before running it. If a command includes encoded text, base64 strings, or references to unknown URLs, it’s almost certainly malicious.

What’s Next

ClickFix campaigns are not going away. As long as forums, chat apps, and social media remain popular for tech support, attackers will craft more convincing lures. The Steam campaign shows that social engineering paired with a trusted administration tool like PowerShell can be devastatingly effective. Windows users should treat every unsolicited command with skepticism, especially when it demands elevated privileges and promises an instant fix for an annoying problem.