Steam discussions can be the best route to a quick fix or otherwise answering your most burning gaming questions. These forums can also be a hive of scum and villainy. Case in point, bad actors have been taking to the Steam forums with fake fixes that end up installing cryptominers on your gaming PC.
An innocent Steam user will post on the discussion board, sharing an issue they’re having with their game. A bad actor then replies in the thread, instructing the user to run PowerShell as an administrator, and then to enter a specific command. This will be presented as a fix, but executing the command will actually download and then launch an executable for an XMRig cryptominer.
Bleeping Computer was the first to report on this style of attack happening across the Steam forums. They note that threat actors had recently targeted posts asking for help with everything from missing in-game items, to crashes.
As the user is instructed to input the code themselves, the cryptominer download sidesteps the sort of security checks that would otherwise cut malicious executable code off at the knees. Called ClickFix, social engineering-style attacks like this are often so elegant, and so devastating to fall prey to. So, consider this your friendly reminder to not just execute operating system commands proffered by Steam forum randos. This trap is a specifically Windows attack, but the advice remains true if you are, say, new to gaming on Linux where trusting someone else’s commands can sometimes feel like the only recourse.
Anyway, let’s say someone takes this threat actor at their word and runs the command as instructed. That launches a PowerShell script calling itself ‘msf utility PC Opt’. Pretending to be a Windows optimization utility, the hapless user will see various messages that claim to be updating drivers, defragging data, and even emptying their recycle bin—though obviously the script isn’t actually doing any of that. To sell the deception, fake progress messages are set to appear randomly in intervals between 1.5 and 8 seconds.
(Image credit: Left: Thana Prasongsin via Getty Images. Right: Pavlo Gonchar/SOPA Images/LightRocket via Getty Images)
The faux-utility’s ‘Advanced-Optimization’ is where the bad actor’s ‘make sure you’re running PowerShell as an administrator’ plea comes into effect. Without admin privileges, the script displays an error message that says it requires these rights, and then closes. With administrator rights, TLS certificate validation gets disabled, and the script creates a ‘C:WindowsBackground’ directory that is excluded from Microsoft Defender’s view.
The dubious script then tells Windows Firewall that it’s totally chill to wave through a connection from ‘msfconfig[.]icu,’ and downloads the XMRig miner. The script then sets up a new scheduled task called ‘XMRig-[your computer name here]’ that ensures it starts up every time you launch Windows. It’s pretty insidious!
If you happen to stumble across either this task, or the aforementioned Windows directory with the Microsoft Defender exception, you may actually be best off reinstalling your operating system from scratch. It’s hard to say what other little nasties the script could be harbouring, and it’s always better to be safe than sorry.
Simply not running random scripts on Windows may seem like a no-brainer for some, but it’s a different ball game on Linux. For those that don’t know, downloading and running random scripts from the internet is how a lot of Linux gamers get the most out of the open-source operating system. If you’re new to gaming on Linux, and not yet down with the code, then this social engineering style attack is particularly scary stuff. Before running anything, make sure you do your research first.
