Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

1. Basic Information

• Article Title: Steam forum ClickFix attacks infect gamers with XMRig cryptominers
• Publisher: BleepingComputer
• Publication Date: July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST
• Original Source: https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/
• Related Information Sources: At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified.
• Related Malware, Threat Groups, CVEs, and Products:
  • XMRig
  • ClickFix
  • PowerShell
  • Microsoft Defender
  • Windows Firewall
  • Windows Task Scheduler
  • Steam Discussion Forums
  • Unknown Threat Group
  • No CVE
• Related IOCs:
  • Domain: msfconfig[.]icu
  • URL: https://msfconfig[.]icu:443/tmp/system.txt
  • Directory: C:\Windows\Background
  • Executable: C:\Windows\Background\system.exe
  • Scheduled Task: XMRig-[computer name]
  • Defender Exclusion: C:\Windows\Background
• Severity: Medium
• Reason for Selection: The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses.

2. Executive Summary

Attackers reply to Steam technical support threads disguised as “repair methods,” instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim’s machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack.

3. Attack Flow

Chain A: XMRig Infection via Steam Forums

1. The attacker creates a randomized Steam account.
2. They search for existing threads discussing game crashes, missing inventory items, or general PC issues.
3. They reply with a purported solution, instructing the user to open PowerShell as an administrator and execute a command.
4. The victim executes the command in an administrator PowerShell window.
5. The script masquerades as a Windows optimization tool named “msf utility \ PC Opt” and displays the following fake progress messages:
   • Deleting temporary files
   • Clearing DNS cache
   • Updating drivers
   • Checking disks
   • Stopping unnecessary startup items
   • Running malware scans
   • Repairing Windows image
   • Running System File Checker
6. It uses randomized delays of 1.5 to 8 seconds along with progress messages to create the illusion of real activity.
7. The Advanced-Optimization function disables TLS certificate validation and verifies administrative privileges.
8. If not running as an administrator, it displays an error stating that privileges are required and terminates.
9. If running as an administrator, it creates C:\Windows\Background and adds the path to Microsoft Defender’s scan exclusions.
10. It attempts to stop and delete any existing XMRig-[computer name] tasks, xmrig or system processes within the target directory, and config.json.
11. It creates an outbound Windows Firewall rule temporarily allowing TCP/443 traffic to msfconfig[.]icu.
12. It downloads the XMRig payload from https://msfconfig[.]icu:443/tmp/system.txt to a temporarily named file.
13. It verifies that the downloaded file is not empty and is a valid executable.
14. It moves the payload to C:\Windows\Background\system.exe.
15. It creates a Scheduled Task named XMRig-[computer name] configured to run system.exe with SYSTEM privileges upon startup.
16. XMRig utilizes the device’s resources to mine cryptocurrency.

Chain B: Re-execution, Updates, or Conflict Resolution

1. The script searches for Scheduled Tasks and processes with the same name.
2. It removes existing tasks, processes, and configuration files.
3. It deploys the new payload and recreates the task.
4. Inference: This may indicate an update to a previous version of the same campaign or the removal of competing XMRig installations.
5. Publicly available information is insufficient to determine the exact intent.

4. Threat Actor Positioning and Execution Locations

• Threat Actor: External accounts replying to victim inquiries on the Steam Discussion Forums.
• Initial Executor: A Steam user attempting to resolve a technical issue.
• Initial Execution Location: Administrator PowerShell on the victim’s Windows machine.
• Defense Evasion & Retrieval: Within the PowerShell script.
• Payload Distribution Source: msfconfig[.]icu:443.
• Persistence & Final Execution: C:\Windows\Background\system.exe launched with SYSTEM privileges via Windows Task Scheduler.
• Mining Destination: Public articles do not disclose the pool, wallet, or protocol.

5. Victim and Administrator Perspectives

Victim

• Appears as a direct response to a specific game or PC issue they posted.
• Mimics standard, advanced troubleshooting procedures (“Open PowerShell as Administrator”).
• False optimization processes, progress indicators, and randomized delays create a strong illusion that a repair is actively taking place.
• Post-infection symptoms may include increased CPU utilization, higher temperatures, fan noise, performance lag, and elevated power consumption.
• Inference: If the miner is configured to throttle its resource usage, the user may remain unaware for an extended period.

Administrator / SOC

• An administrator launches powershell.exe.
• PowerShell creates Defender exclusions, Firewall rules, directories, and Scheduled Tasks.
• A file downloaded with a .txt extension (system.txt) is validated as a PE and moved to system.exe.
• Because Scheduled Tasks incorporate the computer name, the exact task name will vary across devices.
• XMRig or system.exe runs under SYSTEM and communicates externally for extended periods.

6. Conditions for Success and Failure

Conditions for Success

• The attacker successfully replies to Steam support threads.
• The user trusts the response and copies the command.
• The user launches PowerShell with administrator privileges.
• PowerShell execution policy, application control, AMSI, and EDR do not block the script.
• The user has permissions to modify Defender exclusions and Firewall rules.
• Connectivity to msfconfig[.]icu:443 is available.
• The payload is a valid Windows executable.
• The Scheduled Task can be created with SYSTEM execution rights.

Conditions for Failure

• The user does not execute commands sourced from forums.
• The command is executed in a non-admin PowerShell window, causing the script to exit.
• Blocked by PowerShell Constrained Language Mode, WDAC/AppLocker, AMSI, or EDR.
• Tamper Protection or similar controls block modifications to Defender exclusions.
• DNS, proxies, or firewalls block msfconfig[.]icu.
• Creation of Scheduled Tasks or SYSTEM execution is detected and blocked.
• The payload is empty or invalid, halting execution during script validation.

7. What Happens Upon Success

Facts

• C:\Windows\Background is created.
• The directory is added to Microsoft Defender exclusions.
• An outbound TCP/443 Firewall rule is created for msfconfig[.]icu.
• XMRig is deployed as system.exe.
• The XMRig-[computer name] task is registered to run at startup with SYSTEM privileges.

Inference

• CPU, power, and cooling resources are consumed for the attacker’s financial gain.
• Granting administrator PowerShell execution opens the door for actors to swap out XMRig for alternative payloads.
• The Defender exclusion directory can be reused as a hiding place for secondary payloads.

Unconfirmed

• Additional payloads beyond XMRig.
• Credential theft, information stealing, or lateral movement.
• Payload swapping in the event of distribution server compromise.
• Actual infection counts, wallets, and mining revenues.

8. Observable Logs

Email

• This incident originates from Steam forums; no email vectors have been identified.
• Inference: The same commands and URLs could be repurposed across Discord, chat platforms, email, or poisoned generative AI outputs.

Proxy / SWG / DNS

• DNS queries for msfconfig[.]icu.
• GET requests to https://msfconfig[.]icu:443/tmp/system.txt.
• HTTPS traffic initiated by PowerShell User-Agents or powershell.exe.
• Files downloaded with a .txt extension that contain PE headers.
• Post-installation XMRig mining traffic (pool IOCs currently unpublished).

Endpoint / EDR

• Execution of powershell.exe as administrator with associated command lines.
• PowerShell Script Block, Module, and AMSI logs.
• .NET/PowerShell code disabling TLS certificate validation.
• Creation of C:\Windows\Background.
• Modifications to Microsoft Defender exclusion settings.
• Creation of Windows Firewall outbound rules.
• File downloads to temporary storage followed by relocation to system.exe.
• Stopping, deletion, and creation of XMRig-* Scheduled Tasks.
• Termination and startup of xmrig or system processes.
• Deletion of C:\Windows\Background\config.json.
• Execution of system.exe under SYSTEM privileges.

Identity / IdP

• Does not directly abuse IdP authentication mechanisms.
• Heavy reliance on local administrator privileges, UAC elevation, and privileged tokens.
• Inference: If administrator credentials were manually entered by a secondary user, corresponding logon events for that admin account will be generated.

SaaS / Cloud

• Forum replies originating from newly created or low-reputation Steam accounts.
• Multiple accounts posting identical commands, domains, and text templates.
• Steam-side post timestamps, account creation times, and IP addresses are generally inaccessible to victim organizations.

Network

• Outbound 443/TCP connections from PowerShell to the distribution domain.
• Persistent communication from XMRig to mining pools.
• If mining protocols are TLS-encrypted or utilize custom ports, detection must rely on anomalies in destination profiles, periodicity, and traffic volume.

9. Attack Success Evaluation Matrix

Stage Evaluation Criteria Contact Only Browsing Steam posts, viewing links/commands User Action Copying commands, launching Administrator PowerShell Initial Execution Script Block, Advanced-Optimization, fake progress display Defense Evasion & Retrieval Defender exclusion, Firewall rules, system.txt retrieval Malware Deployment C:\Windows\Background\system.exe present as a valid PE Persistence Establishment XMRig-[computer name] task registered for SYSTEM/startup execution Payload Execution SYSTEM system.exe process and outbound communications Mining Success Continuous CPU consumption, pool communications, share transmission Post-Compromise Activity Processes other than XMRig, credential access, secondary C2, lateral movement

Infection success should not be assumed merely because PowerShell executed. Exclusions, retrievals, deployments, tasks, executions, and network communications must be evaluated phase by phase.

10. Investigation Playbook

Trigger

• Administrator PowerShell execution stemming from forums or chat applications.
• Communications to msfconfig[.]icu.
• Creation of C:\Windows\Background or Defender exclusions.
• Presence of XMRig-* tasks.
• Execution of system.exe following system.txt retrieval.

Initial Verification

1. Confirm with the user which posts, URLs, or commands were executed.
2. Preserve Steam post URLs, screenshots, author details, timestamps, and commands.
3. Preserve PowerShell Script Blocks, ConsoleHost history, and EDR process trees.
4. Verify current states and modification timestamps for Defender exclusions, Firewall rules, and Scheduled Tasks.
5. Record hashes, signatures, PE information, and acquisition timestamps before removing payloads.

Endpoint

1. Preserve the entire C:\Windows\Background directory.
2. Inspect system.exe, config.json, temporary files, Prefetch files, Amcache, and USN Journals.
3. Retrieve XML, author details, principals, triggers, and actions for XMRig-* tasks.
4. Correlate Defender Operational, PowerShell, TaskScheduler, Firewall, and Security logs.
5. Investigate non-XMRig child processes, DLLs, services, Run Keys, and WMI persistence.
6. Hunt for matching domains, paths, tasks, and directories across all endpoints.

Authentication & Cloud

1. Verify UAC elevation and local administrator usage.
2. If admin credentials were explicitly entered, check for concurrent and subsequent logons associated with that account.
3. Verify that browser, Steam, email, and SaaS authentications from the device show no anomalies.
4. Distinguish between theoretical possibilities and confirmed facts, as public information does not currently confirm credential theft.

Follow-up Operations

• Check for communications outside the distribution domain, additional file drops, credential access, compression tools, and lateral movement.
• Build timelines for CPU/GPU utilization, outbound connections, and mining pool communications.
• Verify whether distinct payloads were distributed using the same PowerShell script.

Containment

• Isolate infected endpoints.
• Block msfconfig[.]icu and retrieval URLs via DNS, SWG, and firewalls.
• After evidence preservation, remove Scheduled Tasks, Defender exclusions, Firewall rules, and deployed files.
• Revoke credentials and active sessions if administrator credentials were provided.
• Consider OS rebuilding if activities beyond XMRig cannot be ruled out.

Verdict Classification

• ClickFix Contact
• User Command Execution
• Defense Evasion Confirmed
• Payload Downloaded
• XMRig Installed
• SYSTEM Persistence Confirmed
• Mining Activity Confirmed
• Additional Compromise Suspected / Confirmed

11. Defense and Detection Ideas

Single Events

• Addition of Defender exclusions via PowerShell.
• Creation of the C:\Windows\Background directory.
• Creation of XMRig-* tasks.
• Saving and executing system.txt as a PE.
• Disabling of TLS certificate validation via PowerShell.
• Network communications to msfconfig[.]icu.

Time-Series Correlation

Browsing Steam / forums
→ Administrator PowerShell
→ Disable TLS validation
→ Create C:\Windows\Background
→ Defender exclusion
→ Outbound Firewall rule
→ Retrieve system.txt
→ Deploy system.exe
→ XMRig-[hostname] task
→ SYSTEM execution
→ Mining traffic

Enter fullscreen mode Exit fullscreen mode

A high-confidence correlation pattern involves sequential execution of “Defender exclusion + external retrieval + SYSTEM Scheduled Task” within 5 to 15 minutes of running an administrator PowerShell window.

Threat Hunting Perspectives

• Unusual directories created within system paths like C:\Windows matching C:\Windows\Background.
• Task names containing XMRig-, computer names, or execution paths pointing to system.exe.
• Executable files created in specific directories immediately following the addition of Defender exclusions.
• Files downloaded with .txt extensions and subsequently renamed to PE binaries.
• Firewall modifications and outbound HTTPS traffic initiated by PowerShell.
• Executable files displaying high CPU utilization, persistent communications, and user-writeable origins, regardless of whether they are explicitly named xmrig.

Log Deficiencies

• Without PowerShell Script Block Logging enabled, distinguishing between fake progress routines and malicious functions becomes difficult.
• If Defender configuration change audits are not forwarded to a SIEM, defense evasion techniques may be overlooked.
• Scheduled Task creation events alone may lack critical context such as task XML, principals, and actions.
• Without TLS decryption and deep file inspection, PE binaries disguised with .txt extensions cannot be properly identified.
• Without proxy-level Steam browsing logs, tracking the initial vector relies entirely on endpoint histories and user testimony.

Priority Mitigations

1. Prevent general users from maintaining daily local administrator privileges.
2. Implement high-priority detections for PowerShell-driven Defender exclusions, Firewall alterations, and SYSTEM Task creations.
3. Enforce WDAC/AppLocker policies alongside PowerShell Constrained Language Mode.
4. Enable Microsoft Defender Tamper Protection and cloud-delivered protection features.
5. Educate users never to execute administrative commands sourced from forums, videos, or generative AI tools.
6. Build generalized detection logic around post-ClickFix behavioral chains rather than relying solely on individual IOCs.

12. Facts / Inference / Hypothesis

Facts

• Attackers post administrator PowerShell commands disguised as repair methods within Steam troubleshooting threads.
• Scripts display fake optimization processes and randomized delays ranging from 1.5 to 8 seconds.
• The Advanced-Optimization function disables TLS certificate validation and verifies administrator privileges.
• The script creates C:\Windows\Background and adds it to Defender exclusions.
• It retrieves XMRig from https://msfconfig[.]icu:443/tmp/system.txt.
• It deploys the payload as system.exe.
• The XMRig-[computer name] task executes the payload under SYSTEM privileges at startup.
• It attempts to remove existing duplicate tasks, XMRig-related processes, and configuration files.

Inference

• Fake progress bars and randomized delays are designed to manufacture credibility as legitimate repair utilities.
• Requiring administrative privileges ensures that exclusions, Firewall modifications, and SYSTEM persistence mechanisms can be successfully established.
• The core essence of this campaign is not inherently tied to Steam, but rather represents a context-dependent ClickFix paradigm: “presenting a working repair command directly to a user experiencing an active issue.”
• If actors swap out the distribution payload, this framework can easily be repurposed for non-mining compromises.

Hypothesis

• Short-duration correlations involving “PowerShell → Defender exclusion → external retrieval → SYSTEM task” can yield high-fidelity detections regardless of domain or file name variations.
• Following the removal of Steam posts or account suspensions, threat actors may pivot this methodology toward Discord, Reddit, video comments, or generative AI content platforms.
• The routines targeting existing XMRig installations may represent updates within the same campaign rather than competitive removal, though definitive attribution remains unconfirmed.

13. MITRE ATT&CK Mapping

High Confidence

• T1204.004 – User Execution: Malicious Copy and Paste: Users copy and paste forum commands into PowerShell.
• T1059.001 – Command and Scripting Interpreter: PowerShell
• T1562.001 – Impair Defenses: Addition of Microsoft Defender exclusions.
• T1105 – Ingress Tool Transfer: Retrieval of XMRig from external domains.
• T1053.005 – Scheduled Task/Job: Scheduled Task: Startup execution with SYSTEM privileges.
• T1496 – Resource Hijacking: Cryptocurrency mining via XMRig.

Medium Confidence

• T1036 – Masquerading: msf utility \ PC Opt, system.exe, and fake optimization UI displays.
• T1027 – Obfuscated/Compressed Files and Information: Distribution of PEs using .txt extensions. Code obfuscation itself remains unverified.
• T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control: While administrator execution is required, UAC bypass has not been confirmed, resulting in lower confidence for this specific sub-technique.
• T1070.004 – File Deletion: Deletion of existing configuration files (purpose undetermined between cleanup and updating).

14. Unknowns and Areas for Further Investigation

• Full initial commands and script sources posted on Steam threads.
• Cryptographic hashes for the PowerShell scripts and XMRig payloads.
• Specific XMRig configurations, mining pools, and wallet addresses.
• Registrants, certificates, and related domains associated with msfconfig[.]icu.
• Specific Windows Firewall rule names and deletion timelines.
• Feasibility of execution on endpoints running Defender Tamper Protection.
• Additional capabilities and payloads beyond XMRig.
• Total infection counts, targeted geographic regions, and the presence of Japanese-language posts.
• Whether the removal of existing XMRig instances constitutes updates or competitor removal.
• Shared infrastructure and posting templates utilized across Steam accounts.

15. Impact on SOCs

While this campaign targets gamers, it holds direct relevance for enterprise detection and security education. Because victims receive commands framed as direct solutions to active technical problems they are facing, these attacks appear far more trustworthy than generic fake CAPTCHA prompts. In corporate environments, employees frequently copy and paste PowerShell or shell commands from developer forums, GitHub Issues, vendor communities, chat channels, and generative AI responses.

For Security Operations Centers (SOCs), the focus should extend beyond point-in-time IOCs like msfconfig[.]icu or XMRig-. The execution chain where an administrator PowerShell session rapidly chains Defender exclusions, Firewall modifications, external file retrievals, and SYSTEM Scheduled Tasks can easily be repurposed for different ClickFix brands and payloads. This incident serves as a practical model for reducing single-event false positives via time-series correlation.

16. Target-Audience Summaries

For SOCs

• Correlate PowerShell → Defender exclusion → external retrieval → SYSTEM Task within tight timeframes.
• Inspect PE content even when files bear .txt extensions, avoiding reliance solely on exact string matches for system.exe or XMRig-.
• Evaluate progress across distinct phases: contact, command execution, retrieval, deployment, persistence, and mining success.

For Administrators

• Restrict the routine use of local administrator accounts and actively control and audit PowerShell usage, Defender exclusions, and Scheduled Tasks.
• Implement a defense-in-depth strategy combining WDAC/AppLocker, Constrained Language Mode, and Tamper Protection.
• Irrespective of Steam accessibility, strictly prohibit the administrative execution of commands sourced from forums.

For End-Users

• Never blindly copy and paste commands provided in forums, videos, chat rooms, or generative AI outputs into an administrator PowerShell window without understanding their function.
• If you have already executed such a command, notify your security team with the post URL and exact execution timestamp before closing windows or deleting files.