Listen to the episode
TLDR
Cybercriminals are hijacking Steam discussion forums with ClickFix attacks, posting fake troubleshooting tips that trick gamers into running malicious PowerShell commands. These commands silently install XMRig cryptominers that hijack...
How it works
Cybercriminals are hijacking Steam discussion forums with ClickFix attacks, posting fake troubleshooting tips that trick gamers into running malicious PowerShell commands. These commands silently install XMRig cryptominers that hijack...
Red flags
- : Unsolicited "fix" instructions asking you to open PowerShell as Administrator and paste unknown commands Claims of running many optimizations (SFC, DISM, DNS flush, malware scan) with visible progress bars but no real effect Sudden system slowdowns, high CPU usage, or unfamiliar processes named xmrig running in the background
What to do
- 1: Never run PowerShell commands copied from forum posts, chats, or unverified users Check for the directory C:\Windows\Background and a scheduled task named XMRig <your pc name Run a full antivirus scan, remove suspicious Microsoft Defender exclusions, and delete any detected miner files
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/FAQ
Is Steam Forum ClickFix Attacks Push XMRig Cryptominers via Fake Fixes a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Unsolicited "fix" instructions asking you to open PowerShell as Administrator and paste unknown commands Claims of running many optimizations (SFC, DISM, DNS flush, malware scan) with visible progress bars but no real effect Sudden system slowdowns, high CPU usage, or unfamiliar processes named xmrig running in the background
What should I do first?
: Never run PowerShell commands copied from forum posts, chats, or unverified users Check for the directory C:\Windows\Background and a scheduled task named XMRig <your pc name Run a full antivirus scan, remove suspicious Microsoft Defender exclusions, and delete any detected miner files
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.