Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers

A ClickFix social-engineering campaign on Steam forums tricks users into running an administrative PowerShell "fix" that installs a disguised "msf utility\PC Opt" script; the script disables TLS validation, adds a Microsoft Defender exclusion for C:\Windows\Background, downloads XMRig from https://msfconfig.icu:443/tmp/system.txt, moves it to C:\Windows\Background\system.exe, and achieves persistence via a SYSTEM-level scheduled task named XMRig-[computer-name], enabling stealthy Monero mining; the report includes IOCs (file path, task name, domain, outbound TCP 443) and removal recommendations.