Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers. These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.
How the Attack Works
BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people's posts about games crashing, lost inventory items, and other technical issues. The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.
Fake Windows Optimization
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named 'msf utility \ PC Opt.' When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker. However, most of these functions do not perform the tasks they claim.
Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate. The actual malicious activity is hidden in a function named 'Advanced-Optimization', which first disables TLS certificate validation and checks that it is running with administrator privileges.
Malware Installation
If it is not running with elevated privileges, the script displays an error stating that administrator rights are required and exits. Once running with elevated privileges, the script creates the 'C:\\Windows\\Background' directory and adds it as an exclusion to Microsoft Defender's scanning functions. It also attempts to stop an existing scheduled task named 'XMRig-[computer name]' and terminates matching processes named 'xmrig' or 'system' that are running from the installation directory.
The malware then creates a temporary outbound Windows Firewall rule allowing connections to 'msfconfig[.]icu' over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file. Before installing it, the script verifies that the downloaded file is not empty and is a valid executable.
Detection and Removal
As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing. Those who executed the command should check for the 'C:\\Windows\\Background' directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with 'XMRig-'.
If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds. If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\\Windows\\Background, and delete the folder and its contents. Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
Source: BleepingComputer