Steam ClickFix attacks: nobody pastes admin PowerShell

There is no exploit here. No zero-day, no supply-chain compromise, no clever payload delivery. Somebody asks for help because their game keeps crashing, a stranger replies with a fix, and the fix is "open PowerShell as administrator and paste this." That's the whole attack. The Steam forum ClickFix campaign works because pasting a command from a helpful stranger is a normal thing that technical people do every day, and it is the single worst habit on your team.

What actually happened

BleepingComputer reported on July 25 that threat actors are creating throwaway Steam accounts and trawling the discussion forums for posts about crashes, lost inventory items, and other ordinary problems. They reply with a confident-sounding fix: run PowerShell elevated, run this command.

The command pulls an XMRig cryptominer from msfconfig[.]icu and installs it as system.exe. To keep the victim comfortable, it renders a fake "msf utility \ PC Opt" Windows optimization interface — the thing looks like it's doing the tune-up it promised. Meanwhile it drops files in C:\Windows\Background, adds a Microsoft Defender exclusion for that directory, disables TLS certificate validation, and registers a scheduled task named XMRig-[computer name] that runs the miner with SYSTEM privileges at every boot.

Read that persistence chain again, because it's the whole point. The admin prompt is the payload. Everything after it — the Defender exclusion, the SYSTEM-level scheduled task, the hidden directory inside C:\Windows — is only possible because a human clicked Yes on an elevation dialog. There is no vulnerability in this attack chain to patch.

Why ClickFix matters for your business

A cryptominer on a gaming rig is an electricity bill. The same technique against your team is something else entirely. Developers and ops people paste commands from Stack Overflow, GitHub issues, vendor docs, and AI assistants all day long, and elevating a shell is muscle memory. The attacker doesn't need your team to be careless — they need them to be busy and stuck, which is the state they're in every time they go looking for a fix.

Three things worth doing this week, none of which require a security budget:

Kill the habit, not the site. Blocklisting msfconfig[.]icu accomplishes nothing; the next domain is free. Make it a stated team norm that nobody runs an elevated command they can't explain line by line. If you can't read it, you don't run it — and "an AI told me to" is not reading it.

Check for the indicators. They're specific and cheap to sweep: a C:\Windows\Background directory, a Defender path exclusion pointing at it, and any scheduled task starting with XMRig-. If you manage endpoints, that's a three-line query across the fleet.

Watch your Defender exclusions. Exclusions are the quietest privilege in Windows, and the one nobody reviews. An alert on "a new AV exclusion was added" catches this family of attack and a dozen others, and most teams have never configured it.

The workstation your developer games on at night is often the workstation with your production credentials on it. That's the actual exposure.

Sources: BleepingComputer.