Steam forums can be useful when a game stops working, but a recent scam shows why you should treat random command-line fixes with extreme caution. Attackers have been replying to help requests with instructions that tell Windows users to launch PowerShell as an administrator and paste a command that secretly installs an XMRig cryptominer.
The campaign has targeted discussions about several problems, including missing in-game items and crashes. BleepingComputer’s report on the attacks describes the scheme as a form of ClickFix, a social-engineering tactic that convinces victims to run malicious code themselves.
Because the user launches the command manually, the download can get past the protections that might otherwise block an executable. The current attack is aimed specifically at Windows PCs, although the same basic warning applies to anyone who is asked to run an unfamiliar script on another operating system.
How the fake fix works
The command launches a PowerShell script called msf utility PC Opt. It pretends to be a Windows maintenance program, displaying fake messages about updating drivers, defragmenting data, and emptying the Recycle Bin. The progress notices appear at random intervals between 1.5 and 8 seconds to make the process look legitimate.
The script’s supposed “Advanced-Optimization” feature is where administrator access becomes important. Without those permissions, it shows an error and closes. With them, the script disables TLS certificate validation, creates a C:WindowsBackground folder, and adds that folder to Microsoft Defender’s exclusions.
It then adds an exception in Windows Firewall for msfconfig[.]icu, downloads XMRig, and creates a scheduled task named XMRig-[your computer name here]. That task allows the miner to start again whenever Windows launches.
A cryptominer uses the PC’s resources to mine cryptocurrency, which can mean higher processor load, extra heat, poorer performance, and increased power use. The fake maintenance messages are there to keep the victim from noticing what the script is really doing.
What to do if you ran the command
If you find the suspicious scheduled task or the C:WindowsBackground folder with a Microsoft Defender exception, a clean operating-system reinstall is the safest response described in the report. The script may contain other harmful actions beyond the miner, so deleting one file or task may not be enough.
Do not paste PowerShell commands from strangers into an administrator window just because the instructions promise a quick game fix. Check the game’s official support documentation, verify the source of any command, and avoid running code you cannot explain. Microsoft has outlined how ClickFix attacks use convincing instructions to get people to execute malicious commands.
Have you encountered suspicious “fixes” in a Steam discussion? Share your thoughts in the comments, and follow us on X, Bluesky, YouTube, Instagram for more PC gaming news.
