[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKKZBH7wugmFkJpPAwXWByXe6BZdeRFwX8P8qli6mKIo":3},{"article":4,"iocs":41,"watch_terms":53,"solutions":54,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"befcade9-4a99-4c55-a0d2-9d671704bbb5","Steam forum ClickFix attacks infect gamers with XMRig cryptominers","steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers-a7df7f","Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers. [...]","Threat actors are exploiting Steam discussion forums through ClickFix attacks, posing as helpful users offering solutions to game and computer issues. These actors trick victims into running PowerShell commands that secretly download and execute the XMRig cryptominer. The attack leverages social engineering by presenting seemingly legitimate fixes, bypassing some security measures due to user interaction.","Steam forums are targeted by ClickFix attacks using fake game fixes to deploy XMRig cryptominers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsteam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F09\u002F12\u002Fsteam-header-new.jpg","2026-07-25T22:37:47+00:00","2026-07-26T00:00:28.146032+00:00",8,[17,20],{"name":18,"type":19},"Steam","product",{"name":21,"type":22},"PowerShell","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,50],{"type":43,"value":44,"context":45},"domain","msfconfig[.]icu","C2 domain used for downloading XMRig payload.",{"type":47,"value":48,"context":49},"url","https:\u002F\u002Fmsfconfig[.]icu:443\u002Ftmp\u002Fsystem.txt","URL for downloading the XMRig miner payload.",{"type":27,"value":51,"context":52},"XMRig","Cryptominer deployed in the attack.",[18],{"controls":55,"vendors":138},[56,82,111],{"slug":57,"name":58,"problem":59,"products":60},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[61,69,74],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":70,"product_name":71,"url":72,"description":73},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":112,"name":113,"problem":114,"products":115},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[116,123,130],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":112,"product_name":120,"url":121,"description":122},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":127,"url":128,"description":129},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":154},"clickfix-attacks-on-steam-forums-spread-xmrig-cryptominer-via-social-engineering","ClickFix Attacks on Steam Forums Spread XMRig Cryptominer via Social Engineering","Threat actors exploited the trust users place in community forums by impersonating helpful peers and persuading victims to manually execute malicious PowerShell commands — a technique known as ClickFix. Because the user willingly runs the command, many traditional security controls such as email filtering and browser-based script blocking are bypassed entirely. This attack highlights the dangerous intersection of social engineering and user-initiated execution, where human behaviour becomes the primary vulnerability. The XMRig cryptominer silently consumes system resources, causing financial harm to victims while generating revenue for attackers. Organizations and individuals must recognise that legitimate support channels will never ask users to run arbitrary PowerShell commands.",[144,145,146,147,148,149,150,151,152,153],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 16: Application Software Security","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1496: Resource Hijacking","MITRE ATT&CK T1204.002: User Execution – Malicious File",{}]