Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence

Short summary

Attackers are using Steam forum threads to trick users into running malicious PowerShell commands disguised as game repair fixes. The script disables Defender, creates firewall exceptions, downloads XMRig, and establishes persistence via a SYSTEM-privileged scheduled task. The ClickFix pattern is relevant to enterprises where employees may paste commands from untrusted sources including AI chat responses.

• •ClickFix social engineering campaign targets Steam forum users with fake repair commands
• •Malicious PowerShell script adds Defender exclusions, firewall rules, and deploys XMRig cryptominer with SYSTEM persistence
• •Attack pattern translates to enterprise risk where employees copy-paste commands from forums or AI responses

Generated with AI, which can make mistakes.