Steam Scammers Use Forums to Install Cryptocurrency Miners

Malicious actors are preying on Steam users by posting fake fixes to help threads. These 'fixes' contain commands that, when executed, download and install cryptocurrency miners onto the victim's PC.

The technique is called ClickFix and works by posing as a helpful reply in a discussion forum. The attackers frame their response as a legitimate solution to a common problem, such as a game crash or missing in-game items.

When users follow the instructions and paste the command into PowerShell, the malicious script downloads an XMRig miner, disables TLS certificate validation, and adds itself to Microsoft Defender's exclusion list. The miner then registers a scheduled task named after the machine, ensuring it runs with Windows every time.

The recovery advice from experts is clear: if you've fallen victim to this scam, treat your saved passwords and session tokens as compromised, and consider reinstalling your operating system due to the potential for other malicious payloads.