ClickFix on Steam forums: how malicious PowerShell commands install a crypto miner

This year has seen a real boom in ClickFix attacks. It’s such a hit with criminals that we barely finish writing about one variation before it’s time to cover the next.

This time, attackers are targeting gamers: tech journalists spotted posts pushing malicious tips on Steam forums. Here’s what these posts look like, what malware they’re used to spread, and how to keep your device safe.

ClickFix finds its way onto Steam forums

Many gamers turn to their fellow players on Steam forums for help and advice on things like beating a tricky quest, leveling up, scoring the best loot, or working around a bug. And it’s precisely this trust in community advice that attackers have decided to exploit.

The attack starts when criminals reply to someone’s question about game crashes, missing inventory items, or other technical issues. Posing as helpful commenters, they suggest opening PowerShell as an administrator and running a command that supposedly fixes the issue the user is having.

Disguising their post as troubleshooting advice, the malicious actor suggests running PowerShell as an administrator and executing a command that supposedly fixes the user’s issue. Source

As you might guess, running the command doesn’t fix anything — it just opens a whole new can of worms. That’s the whole idea behind ClickFix: using social engineering to trick victims into carrying out unsafe actions themselves while giving the scammers what they need to compromise the device. We’ve covered other ClickFix tricks before — fake CAPTCHAs, bogus browser errors, and more — all of which rely on getting the victim to run the malicious command on their own. You can read more about the different variations of ClickFix attacks in our earlier post.