Executive Summary
Attackers are currently exploiting trust within gaming communities by posing as helpful troubleshooters on Steam forums. This latest iteration of the 'ClickFix' campaign targets technical support threads, providing victims with malicious PowerShell commands disguised as Windows optimization fixes. These commands, once executed by the user with administrative privileges, compromise the system by bypassing built-in security controls and deploying persistent mining software.
The attack chain utilizes common system administration tools like Invoke-RestMethod (irm) and Invoke-Expression (iex) to download and run scripts directly from adversary-controlled infrastructure. By specifically targeting high-performance gaming rigs, threat actors maximize their Monero (XMR) mining efficiency while degrading user hardware performance and system stability.
While Steam is the primary vector mentioned, the broad appeal of community-driven troubleshooting means this technique poses a significant risk to any individual or organization whose employees participate in technical community forums.