The PowerShell script at the center of the campaign downloads an XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt and installs it as a persistent Windows service, BleepingComputer reported.
How attackers weaponize Steam discussion threads with ClickFix social engineering
BleepingComputer learned from a reader that threat actors are creating random Steam accounts to reply to users reporting game crashes, lost inventory and other technical problems. The replies appear to offer helpful fixes, instructing victims to open PowerShell as an administrator and run a command. Those instructions are the hook: when the user executes the command, it quietly downloads and launches an XMRig cryptominer.
These campaigns use a known social-engineering technique called ClickFix, which displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually running malicious commands. Because the victim explicitly runs the code, ClickFix attacks can evade some automated security protections that would otherwise block executed malicious code.
The PowerShell masquerade: “msf utility \ PC Opt”
The distributed PowerShell script presents itself as a Windows optimization utility labeled “msf utility \ PC Opt.” It displays messages claiming to perform a range of maintenance tasks — cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, disabling startup items, scanning for malware, repairing the Windows image, and running System File Checker.
Most of those claimed functions are sham behaviors: the script shows fake progress messages and pauses for a random interval between 1.5 and 8 seconds to create the illusion of legitimate work. The real malicious code is tucked into a function named "Advanced-Optimization," which first disables TLS certificate validation and confirms it is running with administrator privileges; if not, it shows an error and exits.
How the miner is installed and made persistent
Once running with elevated privileges, the script performs a sequence designed to deploy and hide an XMRig miner. It creates the folder C:\Windows\Background and adds that path as an exclusion to Microsoft Defender scanning. The script attempts to stop any existing scheduled task named "XMRig-[computer name]," terminate processes named "xmrig" or "system" that match the installation directory, and delete any config file at C:\Windows\Background\config.json — a cleanup whose exact intent is unclear from the script alone.
The script then adds a temporary outbound Windows Firewall rule permitting connections to msfconfig[.]icu over TCP port 443 and downloads the miner from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file. After verifying the download is non-empty and a valid executable, it moves the file to C:\Windows\Background\system.exe and creates a scheduled task named "XMRig-[computer name]" to launch system.exe with SYSTEM privileges at startup.
Detection signs and step-by-step remediation
According to the reporting, anyone who executed the provided PowerShell command should check for several specific indicators of compromise: the presence of the C:\Windows\Background directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with "XMRig-".
- If those signs are present, run an antivirus or antimalware scanner immediately and remove anything it finds.
- If the scanner does not detect the miner, manually stop and remove the XMRig-[computer name] scheduled task, remove the Defender exclusion for C:\Windows\Background, and delete the folder and its contents.
- The reporting also notes that because the downloaded payload may have performed additional actions while it ran, it may be safer to reinstall the operating system to ensure full eradication.
What this means for end users, security teams, and gaming platforms
End users: Do not run PowerShell commands provided by unknown users in discussion forums, even when those commands are presented as immediate fixes for a current problem. If you have already run such a command, check for the specific artifacts above and run a full antivirus scan.
Security teams: ClickFix-style social engineering bypasses some protections because it relies on deliberate user execution. Watch for Defender exclusions targeting C:\Windows\Background, scheduled tasks that begin with "XMRig-", and temporary firewall rules permitting outbound connections to msfconfig[.]icu on TCP/443 as high-fidelity indicators of this campaign.
Gaming platforms and forum moderators: Threads offering "fixes" that instruct users to run administrative PowerShell commands are a likely vector. Replies from newly created accounts that propose immediate, command-line remedies for crashes or missing items are worth quicker scrutiny and removal.
The campaign is a reminder that an apparently helpful forum reply can be an installation script: the payload is downloaded openly from a named host, is moved into a system folder, and given a scheduled task that runs it with SYSTEM privileges. For anyone tempted to try a command pasted into a discussion thread, the safe choice is simple — don’t run it.
