Users engaging with Steam forums for game-related assistance are being targeted by malicious actors who have been observed distributing PowerShell commands designed to install cryptominers on their PCs. These attacks exploit the trust users place in forum replies, often presented as quick fixes for technical issues.
Threat actors have been observed responding to posts from users seeking help with various problems, including missing in-game items and game crashes. The attackers instruct the user to execute specific PowerShell commands with administrator privileges. This method bypasses standard security measures that would typically block malicious executable code. The attack, reported by Bleeping Computer, has been dubbed 'ClickFix' due to its reliance on social engineering tactics.
When a victim runs the prescribed command, a PowerShell script masquerading as a Windows optimization utility, 'msf utility \ PC Opt,' is launched. This script displays fake progress messages, claiming to update drivers, defrag data, or empty the recycle bin, all while performing none of these actions. These messages appear at random intervals between 1.5 and 8 seconds to enhance the illusion of legitimate activity.
The critical phase of the attack occurs when the script requires administrator privileges. Without these rights, the script aborts, displaying an error message. With administrator rights, however, it disables TLS certificate validation and creates a directory, 'C:\Windows\Background,' which is then excluded from Microsoft Defender scans. Subsequently, the script configures the Windows Firewall to allow connections from 'msfconfig[.]icu,' downloads the XMRig cryptominer, and establishes a scheduled task named 'XMRig-[your computer name here]' to ensure the miner launches automatically with every Windows startup.
Experts suggest that if a system is suspected of being compromised by this script, the safest course of action is to reinstall the operating system entirely, as it is difficult to ascertain if any other malicious software has been installed. The report highlights that while avoiding the execution of random scripts is generally common sense for most Windows users, it can be a particularly dangerous trap for those new to gaming on Linux, where running downloaded scripts is a more common practice for leveraging the open-source operating system. PC Gamer advises all users to exercise caution and conduct thorough research before running any commands obtained from untrusted sources on the internet.