Many gamers visit the Steam community to find information or resolve technical issues. Recently, there have been persistent reports of attacks on Steam forums where malicious actors masquerade as tech support to trick users into installing cryptocurrency miners. Users are advised to exercise caution.

 

The primary reason gamers visit Steam forums is to troubleshoot game-related problems. When a question is posted, developers or other users often provide solutions. However, hackers are now exploiting this trust. They target users seeking fixes for game errors or system issues by inducing them to input commands with administrative privileges.

Attackers monitor Steam discussion boards for threads regarding technical issues or game crashes and reply with a fake solution. The reply instructs the user to open a command prompt (PowerShell) as an administrator and enter a specific command. Once the user executes the command, a cryptocurrency mining executable is downloaded and run. Because the user manually inputs the command, it often bypasses PC security scans.

The malicious command displays a fake interface disguised as a Windows optimization utility. To avoid suspicion, it may randomly display fake status messages—such as updating drivers, defragmenting data, or emptying the recycle bin—at intervals of 1.5 to 8 seconds. If the user lacks administrative privileges, it displays a fake error message and terminates; however, once granted, it installs the mining program into a firewall-exempt folder and configures it to launch automatically upon system startup.

This social engineering technique, which tricks users into copying and executing malicious commands, is known as 'ClickFix.' If you are infected with this malware, it is recommended to format your PC. To avoid ClickFix, never follow instructions to copy and execute code directly into PowerShell, Command Prompt, or any terminal.