Steam forum ClickFix attacks infect gamers with XMRig cryptominers
Threat actors are abusing Steam discussion forums to spread XMRig cryptominers through ClickFix attacks, which trick users into running malicious PowerShell commands.
Intelligence analysis by Llama
Steam forum users are being targeted with fake fixes for game and computer problems that actually download XMRig cryptominers. Users should be cautious when running PowerShell commands from unknown users.
Imagine you're playing a game on Steam and you see a helpful post from someone who claims to have fixed a problem you're having. But instead of fixing the problem, the post actually downloads a malicious program that starts mining cryptocurrency on your computer. This is what's happening in the ClickFix attacks on Steam, where threat actors are posing as helpful users to trick others into running malicious code.
Analysis
A New Twist on Social Engineering Attacks
The recent ClickFix attacks on Steam discussion forums are a prime example of how threat actors are continually evolving their tactics to trick users into running malicious code. By posing as helpful fixes for game and computer problems, these attackers are able to bypass some security protections and infect devices with XMRig cryptominers.
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named 'msf utility \ PC Opt.' When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker. However, most of these functions do not perform the tasks they claim. Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate.
The actual malicious activity is hidden in a function named 'Advanced-Optimization,' which first disables TLS certificate validation and checks that it is running with administrator privileges. If it is not, the script displays an error stating that administrator rights are required and exits. Once running with elevated privileges, the script creates the 'C:\Windows\Background' directory and adds it as an exclusion to Microsoft Defender's scanning functions. It also attempts to stop an existing scheduled task named 'XMRig-[computer name]' and terminates matching processes named 'xmrig' or 'system' that are running from the installation directory. It also attempts to delete any XMRig configuration files stored as C:\Windows\Background\config.json.
The malware then creates a temporary outbound Windows Firewall rule allowing connections to 'msfconfig[.]icu' over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file. Before installing it, the script verifies that the downloaded file is not empty and is a valid executable. If so, it moves the file to C:\Windows\Background\system.exe. So it launches every time Windows starts, it will create a new scheduled task named "XMRig-[computer name]," that launches the system.exe executable with SYSTEM privileges.
As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing. Those who executed the command should check for the 'C:\Windows\Background' directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with 'XMRig-.' If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds. If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents. Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.
Key points
- Threat actors are abusing Steam discussion forums to spread XMRig cryptominers through ClickFix attacks.
- Users should be cautious when running PowerShell commands from unknown users in discussion forums.
- The malware creates a temporary outbound Windows Firewall rule and downloads the XMRig miner payload from a remote server.
- The script verifies that the downloaded file is not empty and is a valid executable before installing it.
- Users should check for the 'C:\Windows\Background' directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with 'XMRig-' if they suspect they have fallen victim to the attack.
If users are cautious and avoid running PowerShell commands from unknown users, they can avoid falling victim to these attacks. Additionally, by being aware of the signs of compromise, such as the 'C:\Windows\Background' directory and the scheduled task beginning with 'XMRig-', users can take action to remove the malware and prevent further damage.
The fact that these attacks are able to bypass some security protections and infect devices with malware is a concern. Additionally, the fact that users are being tricked into running malicious code by posing as helpful fixes for game and computer problems is a sign of the ongoing threat of social engineering attacks.
