Steam forum ClickFix attacks infect gamers with XMRig cryptominers

A ClickFix social-engineering campaign on Steam forums lures users into running a PowerShell “msf utility\PC Opt” script that displays fake maintenance messages while disabling TLS checks and creating persistence and Defender exclusions; it downloads an XMRig cryptocurrency miner from https://msfconfig.icu and installs it as C:\Windows\Background\system.exe with a scheduled task named XMRig-[computer name]. The report describes detection indicators (directory, Defender exclusion, scheduled task) and remediation advice including antivirus scanning, removal of the scheduled task and exclusion, folder deletion, or OS reinstall.