Steam Forums Used to Deliver XMRig via ClickFix

Steam discussion boards are being used to distribute XMRig cryptocurrency malware. BleepingComputer reported on July 25, 2026 that attackers are seeding per-game community threads — the forums where players share workarounds, launch arguments, and config edits — with posts disguised as fixes for common game and system problems. The “fix” is a ClickFix lure: a clipboard command the post instructs the user to paste into the Windows Run dialog. What runs: XMRig.

The mechanism

ClickFix is social engineering, not an exploit. No vulnerability is required on the target machine. The attack works by convincing the user to manually execute a malicious command — typically PowerShell — that has been placed in their clipboard. Browser-based defenses, attachment scanners, and most network perimeter controls don’t catch it because there’s no suspicious download, no link to a known-bad domain, no file transfer. The victim does the execution.

Gaming forums are a reasonable surface for this. Players routinely follow forum advice to edit config files, run console commands, and paste launch arguments. The social context normalizes the behavior the attack requires: “I had this same problem, here’s the fix” is a plausible post in any game’s community thread.

The technique has appeared in fake browser error pages, CAPTCHA impersonations, and malvertising campaigns using the same clipboard-paste delivery chain. The Steam variant applies the same pattern to a different trust environment.

What XMRig does once it’s running

XMRig is open-source Monero mining software — legitimately deployed by administrators on owned hardware. In this context it runs without the owner’s knowledge, consuming CPU cycles to generate Monero for the attacker. In some configurations it also uses GPU capacity. The aggregate effect across a large infection pool is a distributed mining operation running on hardware the attackers don’t pay for or maintain.

For the individual machine: sustained high CPU load, elevated thermal output, possible performance degradation visible during gameplay or other workloads. Users frequently attribute the slowdown to a game update or driver issue and don’t investigate further. That delay is the point — XMRig installed and quiet for weeks generates more revenue than XMRig caught in the first hour.

What to do

If someone on your network recently copied and ran a “fix” from a Steam forum post: check for active miner processes. Sustained high CPU with no obvious owner in Task Manager is the starting point. Check scheduled tasks and startup entries for persistence mechanisms. Full indicators of compromise are in BleepingComputer’s coverage.

The specific defense is simple to state, harder to get users to internalize: any troubleshooting step that requires opening the Windows Run dialog and pasting a command is not a troubleshooting step. Steam forums, game wikis, and Discord support channels don’t need Run-dialog access to solve game problems. If the “fix” requires that, it’s the attack.

For broader threat-intel context, see the Threat Intel & Field Notes topic hub.