Steam Forum “Quick Fix” PowerShell XMRig Miner Scam

Scammers are targeting Steam users with a Windows-focused social engineering scheme that masquerades as a “quick fix,” only to install an XMRig cryptocurrency miner on the victim’s PC. The attack has been seen replying to help-seeking threads across the Steam forums, including posts about missing in-game items and crashes, where the malicious replies push users to run a specific PowerShell command they copy and execute themselves.

The lure is straightforward: an attacker responds to an innocent user’s problem with instructions to run PowerShell as an administrator and then enter a particular command. When followed, the command triggers the download and launch of an executable associated with XMRig, rather than addressing the original game issue.

This approach is designed to bypass protections that would otherwise block malicious code, since the user is the one entering the command. Once the PowerShell command is run, it starts a script disguised as a Windows “optimization utility.” The script identifies itself with a self-referential name and presents a series of misleading status messages, claiming to update drivers, defragment data, and empty the recycle bin. To make the deception more convincing, the fake progress updates appear at irregular intervals ranging from about 1.5 to 8 seconds.

Whether the script proceeds further depends on admin privileges. Without administrator rights, the program displays an error stating it requires elevated permissions and then exits. With administrator rights, the script disables TLS certificate validation, creates a directory at “C:\Windows\Background”, and adds that location to an exclusion list so Microsoft Defender will not scan it.

Next, the malware attempts to relax network defenses by instructing Windows Firewall to allow traffic associated with “msfconfig[.]icu”. It then downloads the XMRig miner. To maintain persistence, the script also creates a scheduled task named “XMRig-[your computer name here]”, ensuring the miner starts automatically whenever Windows boots or the task is triggered.

If you discover evidence of the scheduled task or the Defender-excluded directory used by the script, the safest response may be to reinstall your operating system. The full scope of what else such a script could do is unknown, and the report emphasizes that starting over is often the most reliable way to eliminate any hidden components.

The warning is especially relevant for gamers who rely on community threads for troubleshooting. The attack is specifically aimed at Windows, but the same general principle applies elsewhere: don’t run commands or scripts provided by unknown forum users—especially when the “fix” requires elevated access. For Linux gamers, where installing and running scripts is sometimes part of everyday setup, this kind of social engineering is described as particularly dangerous for newcomers who may feel pressured to follow instructions without verifying what the code actually does.