Steam Forum ClickFix XMRig Cryptomining Campaign

Technical Analysis

The attack follows the classic ClickFix pattern: victims are directed to fake forum posts claiming to resolve game crashes or PC errors, which instruct them to copy a clipboard payload and paste it into the Windows Run dialog (Win+R) or PowerShell, executing a malicious script under the guise of a 'fix'. The script typically downloads and silently installs the XMRig cryptominer, configuring it to mine Monero (XMR) using victim CPU/GPU resources while evading detection through process masquerading and living-off-the-land binaries (LOLBins) such as mshta.exe or PowerShell. No software vulnerability or CVE is exploited; the attack relies entirely on social engineering and user-executed commands, bypassing traditional exploit-based defenses. While primarily targeting gaming consumers, any organization permitting developer or agent workstations to browse gaming/community forums faces risk if AI coding agents or autonomous browser-based agents with clipboard/command execution capabilities interact with such forums and auto-execute suggested 'fixes', potentially leading to resource hijacking or credential exposure on hosts running agent tooling.

Affected Systems

Windows desktop and laptop systems used by Steam community members; systems where users have access to Run dialog/PowerShell/CMD execution; any endpoint with Steam client installed and forum access enabled

Indicators of Compromise

• XMRig miner executable (various hashes, not disclosed in source)
• Malicious PowerShell/clipboard scripts hosted via Steam forum posts
• C2/mining pool domains (not specified in source article)
• Suspicious mshta.exe or powershell.exe child processes spawned from Run dialog

Remediation Steps

1. 1

   User Awareness Training

   Educate users, especially gaming and developer communities, on the ClickFix technique and to never paste/copy clipboard content into Run dialogs, terminals, or PowerShell based on forum instructions.

2. 2

   Restrict Script Execution

   Apply Windows PowerShell Constrained Language Mode, AppLocker, or WDAC policies to prevent unauthorized script execution on endpoints.

3. 3

   Monitor for XMRig Indicators

   Deploy EDR rules to detect XMRig process signatures, high sustained CPU/GPU usage, and connections to known Monero mining pools.

4. 4

   Clipboard Monitoring

   Use endpoint security tools capable of detecting and alerting on clipboard-to-Run-dialog execution patterns characteristic of ClickFix attacks.

5. 5

   Network Egress Filtering

   Block outbound connections to known cryptomining pool domains and IPs at the firewall/proxy level.