GoKawiilSteam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.
BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people's posts about games crashing, lost inventory items, and other technical issues.
The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.
Forum post pushing the ClickFix social engineering attack
Source: BleepingComputer
These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.
Although ClickFix attacks require interaction from the victim, they are effective because they present users with what appears to be both a legitimate solution for a problem they are having.
Since the victim manually launches the command, the attack can also bypass some security protections that would otherwise automatically block executed malicious code.
Fake Windows optimization installs malware
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named "msf utility \ PC Opt."
... continue reading