Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

Anoymask — Mon, 27 Jul 2026 00:12:03 +0000

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

1. Basic Information

Article Title: Steam forum ClickFix attacks infect gamers with XMRig cryptominers
Publisher: BleepingComputer
Publication Date: July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST
Original Source: https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/
Related Information Sources: At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified.
Related Malware, Threat Groups, CVEs, and Products:
- XMRig
- ClickFix
- PowerShell
- Microsoft Defender
- Windows Firewall
- Windows Task Scheduler
- Steam Discussion Forums
- Unknown Threat Group
- No CVE
Related IOCs:
- Domain: msfconfig[.]icu
- URL: https://msfconfig[.]icu:443/tmp/system.txt
- Directory: C:\Windows\Background
- Executable: C:\Windows\Background\system.exe
- Scheduled Task: XMRig-[computer name]
- Defender Exclusion: C:\Windows\Background
Severity: Medium
Reason for Selection: The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses.

2. Executive Summary

Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack.

3. Attack Flow

Chain A: XMRig Infection via Steam Forums

The attacker creates a randomized Steam account.
They search for existing threads discussing game crashes, missing inventory items, or general PC issues.
They reply with a purported solution, instructing the user to open PowerShell as an administrator and execute a command.
The victim executes the command in an administrator PowerShell window.
The script masquerades as a Windows optimization tool named "msf utility \ PC Opt" and displays the following fake progress messages:
- Deleting temporary files
- Clearing DNS cache
- Updating drivers
- Checking disks
- Stopping unnecessary startup items
- Running malware scans
- Repairing Windows image
- Running System File Checker
It uses randomized delays of 1.5 to 8 seconds along with progress messages to create the illusion of real activity.
The Advanced-Optimization function disables TLS certificate validation and verifies administrative privileges.
If not running as an administrator, it displays an error stating that privileges are required and terminates.
If running as an administrator, it creates C:\Windows\Background and adds the path to Microsoft Defender’s scan exclusions.
It attempts to stop and delete any existing XMRig-[computer name] tasks, xmrig or system processes within the target directory, and config.json.
It creates an outbound Windows Firewall rule temporarily allowing TCP/443 traffic to msfconfig[.]icu.
It downloads the XMRig payload from https://msfconfig[.]icu:443/tmp/system.txt to a temporarily named file.
It verifies that the downloaded file is not empty and is a valid executable.
It moves the payload to C:\Windows\Background\system.exe.
It creates a Scheduled Task named XMRig-[computer name] configured to run system.exe with SYSTEM privileges upon startup.
XMRig utilizes the device's resources to mine cryptocurrency.

Chain B: Re-execution, Updates, or Conflict Resolution

The script searches for Scheduled Tasks and processes with the same name.
It removes existing tasks, processes, and configuration files.
It deploys the new payload and recreates the task.
Inference: This may indicate an update to a previous version of the same campaign or the removal of competing XMRig installations.
Publicly available information is insufficient to determine the exact intent.

4. Threat Actor Positioning and Execution Locations

Threat Actor: External accounts replying to victim inquiries on the Steam Discussion Forums.
Initial Executor: A Steam user attempting to resolve a technical issue.
Initial Execution Location: Administrator PowerShell on the victim's Windows machine.
Defense Evasion & Retrieval: Within the PowerShell script.
Payload Distribution Source: msfconfig[.]icu:443.
Persistence & Final Execution: C:\Windows\Background\system.exe launched with SYSTEM privileges via Windows Task Scheduler.
Mining Destination: Public articles do not disclose the pool, wallet, or protocol.

5. Victim and Administrator Perspectives

Victim

Appears as a direct response to a specific game or PC issue they posted.
Mimics standard, advanced troubleshooting procedures ("Open PowerShell as Administrator").
False optimization processes, progress indicators, and randomized delays create a strong illusion that a repair is actively taking place.
Post-infection symptoms may include increased CPU utilization, higher temperatures, fan noise, performance lag, and elevated power consumption.
Inference: If the miner is configured to throttle its resource usage, the user may remain unaware for an extended period.

Administrator / SOC

An administrator launches powershell.exe.
PowerShell creates Defender exclusions, Firewall rules, directories, and Scheduled Tasks.
A file downloaded with a .txt extension (system.txt) is validated as a PE and moved to system.exe.
Because Scheduled Tasks incorporate the computer name, the exact task name will vary across devices.
XMRig or system.exe runs under SYSTEM and communicates externally for extended periods.

6. Conditions for Success and Failure

Conditions for Success

The attacker successfully replies to Steam support threads.
The user trusts the response and copies the command.
The user launches PowerShell with administrator privileges.
PowerShell execution policy, application control, AMSI, and EDR do not block the script.
The user has permissions to modify Defender exclusions and Firewall rules.
Connectivity to msfconfig[.]icu:443 is available.
The payload is a valid Windows executable.
The Scheduled Task can be created with SYSTEM execution rights.

Conditions for Failure

The user does not execute commands sourced from forums.
The command is executed in a non-admin PowerShell window, causing the script to exit.
Blocked by PowerShell Constrained Language Mode, WDAC/AppLocker, AMSI, or EDR.
Tamper Protection or similar controls block modifications to Defender exclusions.
DNS, proxies, or firewalls block msfconfig[.]icu.
Creation of Scheduled Tasks or SYSTEM execution is detected and blocked.
The payload is empty or invalid, halting execution during script validation.

7. What Happens Upon Success

Facts

C:\Windows\Background is created.
The directory is added to Microsoft Defender exclusions.
An outbound TCP/443 Firewall rule is created for msfconfig[.]icu.
XMRig is deployed as system.exe.
The XMRig-[computer name] task is registered to run at startup with SYSTEM privileges.

Inference

CPU, power, and cooling resources are consumed for the attacker's financial gain.
Granting administrator PowerShell execution opens the door for actors to swap out XMRig for alternative payloads.
The Defender exclusion directory can be reused as a hiding place for secondary payloads.

Unconfirmed

Additional payloads beyond XMRig.
Credential theft, information stealing, or lateral movement.
Payload swapping in the event of distribution server compromise.
Actual infection counts, wallets, and mining revenues.

8. Observable Logs

Email

This incident originates from Steam forums; no email vectors have been identified.
Inference: The same commands and URLs could be repurposed across Discord, chat platforms, email, or poisoned generative AI outputs.

Proxy / SWG / DNS

DNS queries for msfconfig[.]icu.
GET requests to https://msfconfig[.]icu:443/tmp/system.txt.
HTTPS traffic initiated by PowerShell User-Agents or powershell.exe.
Files downloaded with a .txt extension that contain PE headers.
Post-installation XMRig mining traffic (pool IOCs currently unpublished).

Endpoint / EDR

Execution of powershell.exe as administrator with associated command lines.
PowerShell Script Block, Module, and AMSI logs.
.NET/PowerShell code disabling TLS certificate validation.
Creation of C:\Windows\Background.
Modifications to Microsoft Defender exclusion settings.
Creation of Windows Firewall outbound rules.
File downloads to temporary storage followed by relocation to system.exe.
Stopping, deletion, and creation of XMRig-* Scheduled Tasks.
Termination and startup of xmrig or system processes.
Deletion of C:\Windows\Background\config.json.
Execution of system.exe under SYSTEM privileges.

Identity / IdP

Does not directly abuse IdP authentication mechanisms.
Heavy reliance on local administrator privileges, UAC elevation, and privileged tokens.
Inference: If administrator credentials were manually entered by a secondary user, corresponding logon events for that admin account will be generated.

SaaS / Cloud

Forum replies originating from newly created or low-reputation Steam accounts.
Multiple accounts posting identical commands, domains, and text templates.
Steam-side post timestamps, account creation times, and IP addresses are generally inaccessible to victim organizations.

Network

Outbound 443/TCP connections from PowerShell to the distribution domain.
Persistent communication from XMRig to mining pools.
If mining protocols are TLS-encrypted or utilize custom ports, detection must rely on anomalies in destination profiles, periodicity, and traffic volume.

9. Attack Success Evaluation Matrix

Stage	Evaluation Criteria
Contact Only	Browsing Steam posts, viewing links/commands
User Action	Copying commands, launching Administrator PowerShell
Initial Execution	Script Block, `Advanced-Optimization`, fake progress display
Defense Evasion & Retrieval	Defender exclusion, Firewall rules, `system.txt` retrieval
Malware Deployment	`C:\Windows\Background\system.exe` present as a valid PE
Persistence Establishment	`XMRig-[computer name]` task registered for SYSTEM/startup execution
Payload Execution	SYSTEM `system.exe` process and outbound communications
Mining Success	Continuous CPU consumption, pool communications, share transmission
Post-Compromise Activity	Processes other than XMRig, credential access, secondary C2, lateral movement

Infection success should not be assumed merely because PowerShell executed. Exclusions, retrievals, deployments, tasks, executions, and network communications must be evaluated phase by phase.

10. Investigation Playbook

Trigger

Administrator PowerShell execution stemming from forums or chat applications.
Communications to msfconfig[.]icu.
Creation of C:\Windows\Background or Defender exclusions.
Presence of XMRig-* tasks.
Execution of system.exe following system.txt retrieval.

Initial Verification

Confirm with the user which posts, URLs, or commands were executed.
Preserve Steam post URLs, screenshots, author details, timestamps, and commands.
Preserve PowerShell Script Blocks, ConsoleHost history, and EDR process trees.
Verify current states and modification timestamps for Defender exclusions, Firewall rules, and Scheduled Tasks.
Record hashes, signatures, PE information, and acquisition timestamps before removing payloads.

Endpoint

Preserve the entire C:\Windows\Background directory.
Inspect system.exe, config.json, temporary files, Prefetch files, Amcache, and USN Journals.
Retrieve XML, author details, principals, triggers, and actions for XMRig-* tasks.
Correlate Defender Operational, PowerShell, TaskScheduler, Firewall, and Security logs.
Investigate non-XMRig child processes, DLLs, services, Run Keys, and WMI persistence.
Hunt for matching domains, paths, tasks, and directories across all endpoints.

Authentication & Cloud

Verify UAC elevation and local administrator usage.
If admin credentials were explicitly entered, check for concurrent and subsequent logons associated with that account.
Verify that browser, Steam, email, and SaaS authentications from the device show no anomalies.
Distinguish between theoretical possibilities and confirmed facts, as public information does not currently confirm credential theft.

Follow-up Operations

Check for communications outside the distribution domain, additional file drops, credential access, compression tools, and lateral movement.
Build timelines for CPU/GPU utilization, outbound connections, and mining pool communications.
Verify whether distinct payloads were distributed using the same PowerShell script.

Containment

Isolate infected endpoints.
Block msfconfig[.]icu and retrieval URLs via DNS, SWG, and firewalls.
After evidence preservation, remove Scheduled Tasks, Defender exclusions, Firewall rules, and deployed files.
Revoke credentials and active sessions if administrator credentials were provided.
Consider OS rebuilding if activities beyond XMRig cannot be ruled out.

Verdict Classification

ClickFix Contact
User Command Execution
Defense Evasion Confirmed
Payload Downloaded
XMRig Installed
SYSTEM Persistence Confirmed
Mining Activity Confirmed
Additional Compromise Suspected / Confirmed

11. Defense and Detection Ideas

Single Events

Addition of Defender exclusions via PowerShell.
Creation of the C:\Windows\Background directory.
Creation of XMRig-* tasks.
Saving and executing system.txt as a PE.
Disabling of TLS certificate validation via PowerShell.
Network communications to msfconfig[.]icu.

Time-Series Correlation

Browsing Steam / forums
→ Administrator PowerShell
→ Disable TLS validation
→ Create C:\Windows\Background
→ Defender exclusion
→ Outbound Firewall rule
→ Retrieve system.txt
→ Deploy system.exe
→ XMRig-[hostname] task
→ SYSTEM execution
→ Mining traffic

A high-confidence correlation pattern involves sequential execution of "Defender exclusion + external retrieval + SYSTEM Scheduled Task" within 5 to 15 minutes of running an administrator PowerShell window.

Threat Hunting Perspectives

Unusual directories created within system paths like C:\Windows matching C:\Windows\Background.
Task names containing XMRig-, computer names, or execution paths pointing to system.exe.
Executable files created in specific directories immediately following the addition of Defender exclusions.
Files downloaded with .txt extensions and subsequently renamed to PE binaries.
Firewall modifications and outbound HTTPS traffic initiated by PowerShell.
Executable files displaying high CPU utilization, persistent communications, and user-writeable origins, regardless of whether they are explicitly named xmrig.

Log Deficiencies

Without PowerShell Script Block Logging enabled, distinguishing between fake progress routines and malicious functions becomes difficult.
If Defender configuration change audits are not forwarded to a SIEM, defense evasion techniques may be overlooked.
Scheduled Task creation events alone may lack critical context such as task XML, principals, and actions.
Without TLS decryption and deep file inspection, PE binaries disguised with .txt extensions cannot be properly identified.
Without proxy-level Steam browsing logs, tracking the initial vector relies entirely on endpoint histories and user testimony.

Priority Mitigations

Prevent general users from maintaining daily local administrator privileges.
Implement high-priority detections for PowerShell-driven Defender exclusions, Firewall alterations, and SYSTEM Task creations.
Enforce WDAC/AppLocker policies alongside PowerShell Constrained Language Mode.
Enable Microsoft Defender Tamper Protection and cloud-delivered protection features.
Educate users never to execute administrative commands sourced from forums, videos, or generative AI tools.
Build generalized detection logic around post-ClickFix behavioral chains rather than relying solely on individual IOCs.

12. Facts / Inference / Hypothesis

Facts

Attackers post administrator PowerShell commands disguised as repair methods within Steam troubleshooting threads.
Scripts display fake optimization processes and randomized delays ranging from 1.5 to 8 seconds.
The Advanced-Optimization function disables TLS certificate validation and verifies administrator privileges.
The script creates C:\Windows\Background and adds it to Defender exclusions.
It retrieves XMRig from https://msfconfig[.]icu:443/tmp/system.txt.
It deploys the payload as system.exe.
The XMRig-[computer name] task executes the payload under SYSTEM privileges at startup.
It attempts to remove existing duplicate tasks, XMRig-related processes, and configuration files.

Inference

Fake progress bars and randomized delays are designed to manufacture credibility as legitimate repair utilities.
Requiring administrative privileges ensures that exclusions, Firewall modifications, and SYSTEM persistence mechanisms can be successfully established.
The core essence of this campaign is not inherently tied to Steam, but rather represents a context-dependent ClickFix paradigm: "presenting a working repair command directly to a user experiencing an active issue."
If actors swap out the distribution payload, this framework can easily be repurposed for non-mining compromises.

Hypothesis

Short-duration correlations involving "PowerShell → Defender exclusion → external retrieval → SYSTEM task" can yield high-fidelity detections regardless of domain or file name variations.
Following the removal of Steam posts or account suspensions, threat actors may pivot this methodology toward Discord, Reddit, video comments, or generative AI content platforms.
The routines targeting existing XMRig installations may represent updates within the same campaign rather than competitive removal, though definitive attribution remains unconfirmed.

13. MITRE ATT&CK Mapping

High Confidence

T1204.004 – User Execution: Malicious Copy and Paste: Users copy and paste forum commands into PowerShell.
T1059.001 – Command and Scripting Interpreter: PowerShell
T1562.001 – Impair Defenses: Addition of Microsoft Defender exclusions.
T1105 – Ingress Tool Transfer: Retrieval of XMRig from external domains.
T1053.005 – Scheduled Task/Job: Scheduled Task: Startup execution with SYSTEM privileges.
T1496 – Resource Hijacking: Cryptocurrency mining via XMRig.

Medium Confidence

T1036 – Masquerading: msf utility \ PC Opt, system.exe, and fake optimization UI displays.
T1027 – Obfuscated/Compressed Files and Information: Distribution of PEs using .txt extensions. Code obfuscation itself remains unverified.
T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control: While administrator execution is required, UAC bypass has not been confirmed, resulting in lower confidence for this specific sub-technique.
T1070.004 – File Deletion: Deletion of existing configuration files (purpose undetermined between cleanup and updating).

14. Unknowns and Areas for Further Investigation

Full initial commands and script sources posted on Steam threads.
Cryptographic hashes for the PowerShell scripts and XMRig payloads.
Specific XMRig configurations, mining pools, and wallet addresses.
Registrants, certificates, and related domains associated with msfconfig[.]icu.
Specific Windows Firewall rule names and deletion timelines.
Feasibility of execution on endpoints running Defender Tamper Protection.
Additional capabilities and payloads beyond XMRig.
Total infection counts, targeted geographic regions, and the presence of Japanese-language posts.
Whether the removal of existing XMRig instances constitutes updates or competitor removal.
Shared infrastructure and posting templates utilized across Steam accounts.

15. Impact on SOCs

While this campaign targets gamers, it holds direct relevance for enterprise detection and security education. Because victims receive commands framed as direct solutions to active technical problems they are facing, these attacks appear far more trustworthy than generic fake CAPTCHA prompts. In corporate environments, employees frequently copy and paste PowerShell or shell commands from developer forums, GitHub Issues, vendor communities, chat channels, and generative AI responses.

For Security Operations Centers (SOCs), the focus should extend beyond point-in-time IOCs like msfconfig[.]icu or XMRig-. The execution chain where an administrator PowerShell session rapidly chains Defender exclusions, Firewall modifications, external file retrievals, and SYSTEM Scheduled Tasks can easily be repurposed for different ClickFix brands and payloads. This incident serves as a practical model for reducing single-event false positives via time-series correlation.

16. Target-Audience Summaries

For SOCs

Correlate PowerShell → Defender exclusion → external retrieval → SYSTEM Task within tight timeframes.
Inspect PE content even when files bear .txt extensions, avoiding reliance solely on exact string matches for system.exe or XMRig-.
Evaluate progress across distinct phases: contact, command execution, retrieval, deployment, persistence, and mining success.

For Administrators

Restrict the routine use of local administrator accounts and actively control and audit PowerShell usage, Defender exclusions, and Scheduled Tasks.
Implement a defense-in-depth strategy combining WDAC/AppLocker, Constrained Language Mode, and Tamper Protection.
Irrespective of Steam accessibility, strictly prohibit the administrative execution of commands sourced from forums.

For End-Users

Never blindly copy and paste commands provided in forums, videos, chat rooms, or generative AI outputs into an administrator PowerShell window without understanding their function.
If you have already executed such a command, notify your security team with the post URL and exact execution timestamp before closing windows or deleting files.

DEV Community: Anoymask

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

1. Basic Information

2. Executive Summary

3. Attack Flow

Chain A: XMRig Infection via Steam Forums

Chain B: Re-execution, Updates, or Conflict Resolution

4. Threat Actor Positioning and Execution Locations

5. Victim and Administrator Perspectives

Victim

Administrator / SOC

6. Conditions for Success and Failure

Conditions for Success

Conditions for Failure

7. What Happens Upon Success

Facts

Inference

Unconfirmed

8. Observable Logs

Email

Proxy / SWG / DNS

Endpoint / EDR

Identity / IdP

SaaS / Cloud

Network

9. Attack Success Evaluation Matrix

10. Investigation Playbook

Trigger

Initial Verification

Endpoint

Authentication & Cloud

Follow-up Operations

Containment

Verdict Classification

11. Defense and Detection Ideas

Single Events

Time-Series Correlation

Threat Hunting Perspectives

Log Deficiencies

Priority Mitigations

12. Facts / Inference / Hypothesis

Facts

Inference

Hypothesis

13. MITRE ATT&CK Mapping

High Confidence

Medium Confidence

14. Unknowns and Areas for Further Investigation

15. Impact on SOCs

16. Target-Audience Summaries

For SOCs

For Administrators

For End-Users