Steam Forum ClickFix Posts Deliver XMRig Cryptominer

Summary

Fake Steam troubleshooting posts reportedly trick users into running PowerShell commands that install XMRig. The script adds a Microsoft Defender exclusion, downloads the miner from msfconfig[.]icu, and creates a persistent scheduled task.

Key points

The reported campaign uses fake Steam accounts to post troubleshooting advice that directs users to run PowerShell as administrator.
The command launches a script disguised as the “msf utility PC Opt” Windows optimization tool; most displayed maintenance tasks are fake progress messages.
The script adds C:\Windows\Background to Microsoft Defender exclusions and downloads the XMRig payload from hxxps://msfconfig[.]icu:443/tmp/system.txt.
It installs the executable as system.exe and creates an “XMRig-[computer name]” scheduled task that runs with SYSTEM privileges.
The article advises checking for the folder, Defender exclusion, and scheduled task; it also recommends scanning for malware and removing those artifacts if found.
The article warns that reinstalling Windows may be safer because the payload could have performed other actions while running.

Article Details

Attack Vectors: Fake Steam accounts post troubleshooting advice that tells users to run PowerShell commands as administrator.
The command downloads and launches an XMRig miner disguised as the “msf utility PC Opt” Windows optimization utility.
The script adds a Microsoft Defender exclusion for C:\WindowsBackground and creates a scheduled task named “XMRig-[computer name]” to launch the miner with SYSTEM privileges.
The script creates a temporary outbound Windows Firewall rule to allow connections to the payload host over TCP port 443.
Defensive Notes: Do not run PowerShell commands supplied by unknown users in discussion forums.
Check for the C:\WindowsBackground directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with “XMRig-”.
If these indicators are found, scan for malware, remove the scheduled task and Defender exclusion, and delete the directory and its contents.
Consider reinstalling the operating system because the article says it is unknown whether the payload performed additional malicious actions.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`msfconfig[.]icu`	Payload host allowed by an outbound Windows Firewall rule and used to download the XMRig miner.
URL	`hxxps[:]//msfconfig[.]icu/tmp/system.txt`	Specific URL used by the script to download the XMRig miner payload.