Steam Forums Become the Latest Hunting Ground for Cryptojackers
A sophisticated wave of ClickFix cryptominer attacks is targeting gamers through Steam's community forums, deploying the widely known XMRig cryptocurrency mining software onto victims' machines without their knowledge or consent. Security researchers have identified a pattern of malicious posts designed to trick users into executing commands that silently install the miner, effectively conscripting victims' hardware into mining operations that benefit the attackers. For privacy professionals, IT decision makers, and security-aware users, this campaign illustrates how rapidly threat actors are evolving their social engineering playbooks — moving away from traditional phishing emails and targeting the platforms where digital communities actually spend their time.
The ClickFix technique, which has gained significant traction in the cybersecurity threat landscape over the past year, exploits a simple but devastatingly effective psychological mechanism: it presents users with a fake error message or technical problem, then instructs them to run a "fix" — typically a clipboard-injected PowerShell or terminal command — that actually executes the malicious payload. When deployed on a high-trust platform like Steam, where millions of gamers regularly seek technical help from fellow community members, the social credibility of the forum environment dramatically lowers users' defenses. According to reporting by BleepingComputer, the campaign specifically leverages Steam's discussion boards to spread these fraudulent fix instructions at scale.
How the ClickFix Attack Chain Turns Helpful Advice Into a Malware Delivery Mechanism
The mechanics of a ClickFix attack are deceptively simple, which is precisely what makes them so dangerous. An attacker posts on a Steam forum thread — often one related to a game crash, performance issue, or connectivity problem — presenting what appears to be a working solution. The post instructs the reader to open their Windows Run dialog or PowerShell terminal and paste in a command string. That command, however, does not fix any technical issue. Instead, it reaches out to an attacker-controlled server, downloads the XMRig miner payload, and installs it as a background process that begins mining Monero (XMR) cryptocurrency for the attacker.
XMRig is an open-source, high-performance cryptocurrency miner that has been widely co-opted by threat actors precisely because it is legitimate, well-maintained software. Its legitimate status makes it harder to detect with standard antivirus tools, and its command-line nature means it can run invisibly in the background without triggering obvious user-visible alerts. Monero is the preferred currency for cryptojacking operations because its privacy-preserving architecture — including ring signatures and stealth addresses — makes transaction tracing significantly more difficult than Bitcoin or Ethereum. Research from Kaspersky's threat intelligence team has consistently identified XMRig as one of the most commonly detected unwanted mining tools across enterprise and consumer endpoints alike.
What distinguishes ClickFix from older malware delivery techniques is the degree to which it relies on the victim's own actions — and, crucially, their trust in the community platform. Unlike drive-by downloads or malicious attachments, ClickFix requires the user to manually copy and run a command. This means that by the time the attack succeeds, the victim has actively participated in their own compromise, which also complicates attribution and incident response.
"Social engineering through community platforms is among the hardest threat vectors to defend against, because the attack surface is human trust rather than technical vulnerability. When the platform itself has good reputation, users extend that trust to every post they read."
— Security researcher, threat intelligence communityWhy Gaming Platforms Are an Increasingly Attractive Target for Cybercriminals
Gaming platforms represent an especially rich attack surface for several converging reasons. Steam alone has hundreds of millions of registered accounts, with tens of millions of daily active users. These users are frequently technically curious — willing to run scripts, modify game files, and follow community instructions to solve problems — but may not have formal security training. The willingness to execute commands in order to "fix" a beloved game is far higher among this demographic than, say, a finance professional who has undergone corporate cybersecurity awareness training.
Furthermore, gaming hardware tends to be powerful. High-end GPUs and multi-core CPUs optimised for gaming workloads are exactly the computing resources that cryptomining operations need. A single high-end gaming rig infected with XMRig can generate meaningful mining revenue for an attacker, and a botnet of thousands of such machines — all deployed via a single viral forum post — represents a significant financial opportunity. According to data from Trend Micro's threat research division, cryptojacking remains one of the most financially efficient attack types for low-sophistication threat actors, requiring minimal infrastructure and delivering sustained passive income.
The broader threat context is alarming for IT and security teams. Picus Security's research indicates that security operations centres log only 54% of successful attacks, and generate alerts on just 14% of intrusions. This means that for every ten ClickFix infections that succeed, fewer than two will trigger any kind of security alert — leaving the vast majority to run undetected for days, weeks, or even months. When the payload is a silent background process like XMRig rather than a noisy ransomware deployment, the detection gap grows even wider.
The Detection Gap: Why XMRig Slips Past Most Security Tools
One of the most troubling aspects of ClickFix cryptominer attacks is how cleanly they evade conventional endpoint detection. Because ClickFix leverages legitimate system tools — Windows PowerShell, Run dialog, or the command prompt — the initial execution stage appears entirely normal from an EDR perspective. There is no malicious binary being dropped in the traditional sense; the user is simply running a command. This "living off the land" (LotL) technique has become the dominant evasion method for advanced persistent threats and commodity malware alike.
The XMRig payload itself compounds the detection problem. Security vendors must be careful about how aggressively they flag XMRig, since it is also used legitimately by hobbyist miners on their own hardware. This ambiguity creates a grey zone that attackers deliberately exploit. According to analysis from CrowdStrike's cybersecurity research team, cryptojacking payloads frequently use process name spoofing, scheduled task persistence, and registry modifications to survive reboots and blend in with legitimate system activity.
For enterprise environments and small businesses with employees who game on work-adjacent hardware — or who bring compromised personal machines into hybrid work setups — the risk is particularly acute. An XMRig infection on a personal laptop that also accesses corporate VPNs or cloud environments creates a potential lateral movement opportunity. The miner itself may be the visible payload, but the initial access broker who sold the ClickFix campaign may have installed additional implants or remote access tools alongside it.
| Attack Stage | Technique Used | Detection Difficulty |
|---|---|---|
| Initial Access | Social engineering via Steam forum post | High — no technical indicator |
| Execution | User-run PowerShell / Run dialog command | High — legitimate system tool |
| Payload Delivery | Download from attacker-controlled server | Medium — network monitoring may flag |
| Persistence | Scheduled tasks / registry modifications | Medium — endpoint tools may detect |
| Impact | XMRig running as background process | Low visibility — legitimate software |
Broader Cybersecurity Implications for IT Teams and Privacy-Conscious Users
The ClickFix Steam campaign is not an isolated incident. The technique has been observed across multiple platforms in recent months, including GitHub issues, Reddit threads, and even Google Ads campaigns. What makes the Steam deployment notable is the scale of the potential victim pool and the specific hardware profile of the targets. Security teams should treat this as a signal that ClickFix is maturing from a novel attack vector into a mainstream commodity technique that will appear across virtually every community platform.
For organisations operating under GDPR or other data protection frameworks, a ClickFix infection carries compliance implications beyond the immediate performance impact of cryptomining. If an infected endpoint is later used to access personal data — customer records, HR systems, financial data — the compromise may need to be assessed as a potential personal data breach under Article 33 of the GDPR, triggering notification obligations to supervisory authorities within 72 hours. The European Union Agency for Cybersecurity (ENISA) has published guidance on incident response and breach notification that is directly relevant to organisations managing endpoints that may be exposed to this type of social engineering campaign.
The attack also underscores a fundamental tension in endpoint security: the more organisations restrict what users can execute on their machines, the more friction is introduced into legitimate workflows. Developers, IT administrators, and technically sophisticated users regularly need to run scripts and commands as part of their daily work. Blanket restrictions on PowerShell execution are not practical in most environments. Instead, the appropriate response involves a combination of user
Originally reported by BleepingComputer. Summarised and curated by European Purpose.
