Steam Forum “Fix” Posts Push Malicious PowerShell

How the Attack Worked

This campaign relied on newly created Steam accounts posing as helpful community members. These accounts replied to real forum threads where users were asking for help with crashes, missing items, or other common gaming and PC issues. Instead of pointing to Valve's official support, the replies told users to open PowerShell as Administrator and paste in a specific command, a technique known as ClickFix.

Once executed, the script displayed itself as a Windows optimization tool, complete with fake progress messages and delays for tasks like temporary file cleanup, DNS cache flushing, and disk checks. Behind that fake interface, the script created a directory at C:\Windows\Background, added it to Microsoft Defender exclusions, and downloaded a payload disguised as system.txt from msfconfig[.]icu over HTTPS. The payload was the XMRig cryptocurrency miner, and the script set up a scheduled task to keep it running automatically at startup.

Why It Succeeded

The attack worked because it inserted itself into a moment when users were already looking for help and were primed to follow instructions. A few factors made it convincing:

• The lure appeared inside legitimate troubleshooting threads, not as an unsolicited message
• The fake optimization tool used progress messages and delays to look like a real utility performing real work
• The request to run PowerShell as administrator was framed as a routine part of fixing a technical problem
• The payload was disguised as a plain text file and delivered over HTTPS, which can appear less suspicious than an executable download

What to Watch For

Security teams and end users can look for a specific set of indicators tied to this campaign:

• A C:\Windows\Background directory that should not normally exist
• Microsoft Defender exclusions that were not set by IT or the user
• Scheduled tasks with names beginning with XMRig-
• Outbound network traffic to msfconfig[.]icu

Any request to paste and run PowerShell or Command Prompt commands from an untrusted forum post, especially one requiring administrator privileges, should be treated as a red flag.

How to Build Resistance

Organizations can reduce risk from this style of attack by reinforcing a few habits. Users should never execute PowerShell or Command Prompt commands from online forums unless the source can be trusted, and any troubleshooting request tied to admin rights or security setting changes, such as Defender exclusions, should be escalated rather than followed. If indicators of compromise are found, affected systems should be isolated from the network immediately, scanned fully with antivirus or EDR tooling, and any scheduled tasks, exclusions, or related files removed manually as part of remediation.

What is a ClickFix attack?

A ClickFix attack instructs users to open PowerShell, Command Prompt, or the Windows Run dialog and directly enter or paste a specific command, disguising malicious activity as a helpful fix.

How did attackers use Steam forums in this campaign?

Attackers used newly created Steam accounts to reply to users asking for help with crashes, missing items, and other tech issues, posting fake troubleshooting steps that led to running PowerShell as administrator.

What happened after the PowerShell command was run?

A script that appeared to be a Windows optimization tool ran fake progress messages, then downloaded an executable disguised as a text file, added a Microsoft Defender exclusion, and set persistence through a scheduled task to install an XMRig cryptocurrency miner.

How can someone check if they were affected?

Defenders can look for a C:\Windows\Background directory, Microsoft Defender exclusions, scheduled tasks beginning with XMRig-, and network traffic to msfconfig[.]icu, then isolate the system and run a full antivirus or EDR scan if found.