Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence
Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence 1. Basic Information Article Title : Steam forum ClickFix attacks infect gamers with XMRig cryptominers Publisher : BleepingComputer Publication Date : July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST Original Source : https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/ Related Information Sources : At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified. Related Malware, Threat Groups, CVEs, and Products : XMRig ClickFix PowerShell Microsoft Defender Windows Firewall Windows Task Scheduler Steam Discussion Forums Unknown Threat Group No CVE Related IOCs : Domain: msfconfig[.]icu URL: https://msfconfig[.]icu:443/tmp/system.txt Directory: C:\Windows\Background Executable: C:\Windows\Background\system.exe Scheduled Task: XMRig-[computer name] Defender Exclusion: C:\Windows\Background Severity : Medium Reason for Selection : The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses. 2. Executive Summary Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack. 3. Attack Flow Chain A: XMRig Infection via Steam Forums The attacker creates a randomized Steam account. They search for existing threads discussing game crash