Steam forum ClickFix attacks infect gamers with XMRig cryptominers

Threat actors exploited the trust users place in community forums by impersonating helpful peers and persuading victims to manually execute malicious PowerShell commands — a technique known as ClickFix. Because the user willingly runs the command, many traditional security controls such as email filtering and browser-based script blocking are bypassed entirely. This attack highlights the dangerous intersection of social engineering and user-initiated execution, where human behaviour becomes the primary vulnerability. The XMRig cryptominer silently consumes system resources, causing financial harm to victims while generating revenue for attackers. Organizations and individuals must recognise that legitimate support channels will never ask users to run arbitrary PowerShell commands.