Steam ClickFix Attacks Deploying XMRig Cryptominers via Fake Game Fixes

Steam Forums Used to Spread Cryptominer via ClickFix Social Engineering

Attackers are actively abusing Steam discussion forums in a ClickFix campaign that tricks gamers into running malicious PowerShell commands under the guise of fixing game crashes or performance issues. The payload is XMRig, an open-source Monero miner that silently burns CPU cycles and electricity on victim machines.

How the Attack Works

ClickFix is a well-established social engineering technique where victims are shown a fake error dialog or "fix" instruction that prompts them to open a Run dialog (Win+R) or PowerShell terminal and paste in an attacker-supplied command. On Steam forums, posts impersonate helpful community members responding to common game issues. The "fix" is a one-liner that fetches and executes a remote script, which drops and launches XMRig.

The attack is effective because:

• Steam forums are trusted community spaces — players expect legitimate troubleshooting advice there
• The ClickFix pattern bypasses most endpoint controls since the user executes the command with their own privileges
• XMRig is legitimate open-source software, so it may not trigger AV signatures on arrival
• Monero's untraceable transactions make the mined funds difficult to follow

While XMRig is "just" a miner today, the same delivery mechanism can trivially swap in a RAT, ransomware, or infostealer. The initial access technique is the threat, not the specific payload.

What You Need to Do

If you manage systems used for gaming (shared workstations, developer laptops, family machines):

1. Alert your users now. No legitimate game fix will ever ask you to open PowerShell and paste a command. If a forum post does this, close the tab.
2. Hunt for XMRig. Check running processes for xmrig.exe or unusual CPU spikes (Task Manager → sustained 80-100% on xmrig, wmplayer, or randomized binary names). On managed endpoints, query your EDR for execution of xmrig or connections to known mining pool domains (pool.supportxmr.com, xmr.2miners.com, etc.).
3. Block PowerShell-from-browser patterns. Application control policies (AppLocker, WDAC) can prevent browser or web-spawned PowerShell from executing arbitrary downloads. If you're not enforcing this already, now is a good time.
4. Check scheduled tasks and startup entries. XMRig drops often persist via schtasks or HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Run schtasks /query /fo LIST /v | findstr /i "xmrig" and check autoruns.
5. Report abusive Steam posts. Use Steam's report function on any forum post pushing clipboard-paste "fixes." Valve does remove these, but turnaround is not instant.

This campaign requires no exploit, no zero-day, and no phishing email — just a convincing post in a place people already trust. The barrier to victimization is entirely social, which makes user awareness the primary control.