Steam Forum ClickFix Attacks Infect Gamers With XMRig Cryptominers

Threat actors are targeting gamers on Steam discussion forums using the social engineering technique known as ClickFix attacks to deploy XMRig cryptominers. By posing as helpful community members offering fixes for game launch failures, graphics glitches, or missing system files, attackers trick users into manually executing malicious PowerShell scripts on their Windows machines.

ClickFix Tactics Move to Steam Discussions

The ClickFix tactic—previously observed abusing compromised web pages, fake CAPTCHA prompts, and GitHub repositories—has now adapted to gaming communities. Attackers create threads in Steam Community discussion hubs for popular titles, claiming to offer quick solutions for frustrating technical issues like DirectX errors, missing DLL files, or crashing game launchers.

Rather than linking directly to an executable file (which Steam’s link filters or standard browser warnings might flag), the posts instruct users to open the Windows Run dialog box (Win+R), paste a provided command snippet, and press Enter.

How the Attack Payload Delivers Cryptominers

When a user pastes and runs the command, it invokes PowerShell to silently fetch and execute a secondary payload from a remote server. The script establishes system persistence and installs an XMRig cryptominer binary configured to mine Monero (XMR) using the victim’s hardware resources.

Because the user manually triggers execution through standard Windows administration utilities like powershell.exe or Windows Terminal, traditional endpoint protections and web filters are less likely to block the initial interaction. Victims typically only realize their machine is compromised when experiencing severe performance degradation, unusual fan noise, or high CPU and GPU utilization during idle periods.

Defense and Mitigation

Gamers should never copy and paste command-line scripts or obfuscated code from public discussion forums into the Windows Run dialog or PowerShell prompt. Valid software patches and driver updates are delivered through official distribution platforms or developer websites, not manually pasted shell commands.

System administrators and defenders managing endpoints where gaming software is present should enforce PowerShell Constrained Language Mode, restrict execution policies, and monitor process creation events (Event ID 4688 or Sysmon Event ID 1) for powershell.exe or cmd.exe launched with encoded command flags (-Enc or -EncodedCommand). Network security tools should also be configured to alert on outgoing connections using the Stratum mining protocol or reaching out to known Monero mining pool IP addresses.