Steam ClickFix Attacks: XMRig Cryptominer Detection and Mitigation

Introduction

The Steam Community forums, a trusted hub for millions of gamers, are currently being abused in a widespread "ClickFix" campaign. Attackers are leveraging the trust of the platform to distribute XMRig cryptominers under the guise of legitimate technical support for common game errors.

For defenders, this represents a shift in vector rather than technology. While the payload is commodity cryptojacking malware, the delivery mechanism—social engineering via trusted gaming communities—bypasses traditional email filtering. Users are being tricked into copying and pasting malicious PowerShell or Batch commands into their terminals to "fix" non-existent game errors, resulting in immediate resource theft and potential lateral movement risks.

Technical Analysis

Affected Products & Platforms:

Platform: Windows (Primary target for XMRig).
Vector: Steam Community Discussion Forums.

Attack Chain Breakdown:

Lure: Threat actors post in Steam forums offering "fixes" for generic errors (e.g., startup crashes, missing .dll files, or DirectX errors).
Deception: The post instructs the user to run a command sequence, often masquerading as a driver update or a dependency installer.
Execution: The user executes a PowerShell or CMD command (ClickFix) that reaches out to external infrastructure (often GitHub or raw CDNs) to download the XMRig binary.
Payload: XMRig is executed, often with administrative privileges if the user right-clicked "Run as Administrator." It connects to Monero mining pools via Stratum protocol (usually TCP ports 3333, 4444, or 8080).

Exploitation Status:

Status: Active Exploitation (Confirmed).
CVE: None. This campaign relies on social engineering and misuse of legitimate administrative tools, not a software vulnerability.

Detection & Response

Sigma Rules

YAML

---
title: Potential XMRig Cryptominer Execution
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of XMRig cryptominer, commonly distributed via Steam ClickFix campaigns. Identifies standard XMRig command-line flags like pool connection (-o) and user configuration (-u).
references:
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.resource-hijacking
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmrig_ctl.exe'
  selection_cli:
    CommandLine|contains:
      - '--donate-level'
      - '--url='
      - 'stratum+tcp://'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration of authorized mining operations
level: high
---
title: Suspicious PowerShell via ClickFix Pattern
description: Detects PowerShell commands often used in ClickFix attacks involving compressed strings, web downloads, and base64 decoding, typical of Steam forum "fixes."
status: experimental
id: 9d3e4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'FromBase64String'
    CommandLine|contains:
      - 'pastebin.com'
      - 'raw.githubusercontent.com'
      - 'bit.ly'
  condition: selection
falsepositives:
  - Administrative scripts
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for XMRig Process Creation and Network Connections
let MiningPorts = dynamic([3333, 4444, 14444, 8080, 9999]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "xmrig.exe" 
   or ProcessCommandLine has "stratum+tcp" 
   or ProcessCommandLine has "--donate-level"
| join kind=inner (DeviceNetworkEvents 
    | where RemotePort in (MiningPorts) 
    | project DeviceId, RemoteIP, RemoteUrl, RemotePort) on DeviceId 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend AlertDetail = "Possible XMRig Cryptominer Activity associated with Steam ClickFix"

Velociraptor VQL

VQL — Velociraptor

-- Hunt for XMRig artifacts and common ClickFix drop locations
SELECT 
  OSPath, 
  Size, 
  Mtime, 
  Atime 
FROM glob(globs="\\Users\\*\\Downloads\\xmrig*.exe") 

UNION ALL

SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist() 
WHERE Name =~ "xmrig" 
   OR CommandLine =~ "stratum+tcp"

Remediation Script (PowerShell)

PowerShell

# Remediation Script for XMRig ClickFix Infection
# Requires Administrative Privileges

Write-Host "[+] Starting XMRig ClickFix Remediation..." -ForegroundColor Cyan

# 1. Terminate malicious processes
$maliciousProcesses = @("xmrig.exe", "xmrig_ctl.exe")
foreach ($proc in $maliciousProcesses) {
    $p = Get-Process -Name $proc.Trim(".exe") -ErrorAction SilentlyContinue
    if ($p) {
        Write-Host "[!] Terminating process: $proc" -ForegroundColor Yellow
        Stop-Process -Name $proc.Trim(".exe") -Force
    }
}

# 2. Remove common persistence and drop locations
$pathsToDelete = @(
    "$env:APPDATA\xmrig",
    "$env:LOCALAPPDATA\xmrig",
    "$env:TEMP\xmrig",
    "$env:USERPROFILE\Downloads\xmrig.exe"
)

foreach ($path in $pathsToDelete) {
    if (Test-Path $path) {
        Write-Host "[!] Deleting artifact: $path" -ForegroundColor Yellow
        Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue
    }
}

# 3. Remove Run Registry Keys (Persistence)
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item -Path $key | ForEach-Object {
            $_.Property | ForEach-Object {
                $propValue = (Get-ItemProperty -Path $key -Name $_).$_
                if ($propValue -like "*xmrig*" -or $propValue -like "*powershell*iex*") {
                    Write-Host "[!] Removing persistence key: $_" -ForegroundColor Yellow
                    Remove-ItemProperty -Path $key -Name $_ -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }
}

Write-Host "[+] Remediation complete. Please advise user to change passwords and perform a full AV scan." -ForegroundColor Green

Remediation

Immediate System Isolation: If a host is confirmed infected, isolate it from the network to prevent propagation and stop communication with mining pools.
User Education (Critical): Inform the user base that legitimate game fixes will never require them to run raw PowerShell commands downloaded from a forum. Steam support will not ask users to paste scripts into CMD.
Network Blocking: Configure firewalls and proxies to block access to known cryptocurrency mining pools and high-risk BitTorrent/CDN repositories if not business-required.
Execution Policy Restriction: Enforce PowerShell Execution Policies (e.g., Restricted or AllSigned) via Group Policy to prevent the execution of unsigned, downloaded scripts.
Application Control: Implement AppLocker or Windows Defender Application Control (WDAC) rules to block unsigned executables in user profile directories (Downloads, AppData, Temp).

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub