Threat actors are operating a ClickFix social engineering campaign on Steam discussion forums, creating fake accounts that reply to players’ technical support posts with troubleshooting instructions that deliver the XMRig Monero cryptocurrency miner at SYSTEM-level privileges — with Windows Defender disabled and persistence that survives reboots.
How Fake Steam Support Accounts Deliver XMRig Through Voluntary PowerShell Execution
The campaign begins with attackers creating random Steam accounts and monitoring game-specific discussion forums for posts from players reporting crashes, lost inventory, or other technical problems. When a qualifying post appears, the fake account replies with a convincing set of troubleshooting steps. The final step instructs the player to run a PowerShell command as administrator. That command downloads and silently installs XMRig, disguised as a Windows optimization tool named “msf utility PC Opt.”
Fake progress messages displayed during execution simulate legitimate Windows operations — DNS flushing, driver updates, and malware scanning — to keep victims engaged and reduce the likelihood they will interrupt the process before installation completes. By the time the progress display finishes, XMRig is running and configured for persistence.
The “msf utility PC Opt” Masquerade and Fake Windows Progress Messages
The XMRig payload presents itself as a routine system optimization utility throughout the installation sequence. The fake progress messages that accompany the install are designed to match the visual cadence of legitimate Windows diagnostic tools: they cycle through plausible-sounding operations at realistic speeds, displaying status updates that would look familiar to a user who had previously run a Windows system repair or driver update. The masquerade serves a specific purpose — the longer a victim remains engaged without suspicion, the less likely they are to close the terminal window or open Task Manager to investigate what is actually running.
SYSTEM-Level Scheduled Task and Windows Defender Evasion in C:WindowsBackground
XMRig is configured to run with SYSTEM-level privileges through a persistent scheduled task that survives system reboots. The miner’s files are stored in the C:WindowsBackground directory, and Windows Defender protection is disabled for that directory, preventing the default antivirus from detecting or quarantining the miner. The SYSTEM-level execution context gives XMRig unrestricted access to CPU resources and allows the scheduled task to persist without the elevated user account that created it needing to remain active. A player who logs out or changes accounts does not disrupt the mining operation.
Steam Forum Scale and the Social Engineering Conditions That Enable This XMRig Campaign
Steam hosts over 2 billion forum posts across thousands of game communities, giving attackers an effectively unlimited supply of targeted lure opportunities matched to players actively experiencing technical distress. The social engineering conditions in game support forums are unusually favorable for this attack type: users are seeking help, are accustomed to running scripts for game mods and anti-cheat software, and tend to trust community responders who provide plausible-looking solutions. Players experiencing a game crash or inventory loss are motivated to try whatever fix is suggested, particularly if it comes from an account with a believable profile.
The ClickFix technique exploits voluntary execution specifically to bypass application controls that would block XMRig if it were delivered through conventional download-and-execute channels. Because the player runs the PowerShell command themselves, as administrator, the operating system treats the action as authorized. Endpoint security tools configured to block unknown executable downloads do not intercept a command the user initiated from an elevated terminal. The campaign’s effectiveness depends entirely on the victim’s willingness to follow the fake troubleshooting instructions — a vulnerability that antivirus signatures and firewall rules cannot address at the technical layer. The SYSTEM-level scheduled task ensures XMRig continues running across reboots, making each compromised gaming machine a persistent contributor to the campaign’s broader cryptomining operation.
