The Lure Is Trust, Not a Vulnerability
We keep telling boards that the most reliable attack path into an endpoint is a person, and this campaign is a clean demonstration. Threat actors register throwaway Steam accounts and troll the discussion forums for users complaining about game crashes, lost inventory, and other technical headaches. They reply with what reads as a friendly, competent fix: open PowerShell as an administrator and run this command. There is no exploit, no dropped attachment, and no drive-by. The victim does the work, which is precisely why the technique, known as ClickFix, has spread so quickly across the threat landscape in 2026.
BleepingComputer, which learned of the campaign from a reader who encountered the malicious posts, reports the activity surfaced publicly around July 25, 2026. The gaming context makes it effective because the audience skews toward users who are comfortable tinkering with their own machines and who trust peer advice on a platform they use daily. That same profile describes plenty of employees who work from personal devices or bring gaming machines onto home networks that also carry corporate sessions. The lure changes with the venue, the mechanism does not.
What the PowerShell Command Actually Does
The pasted command pulls down a script that presents itself as "msf utility \\ PC Opt," a Windows optimization tool. To sell the disguise, it prints fake progress messages claiming to clean temporary files, flush DNS, update drivers, check the disk, and scan for malware, with randomized pauses of 1.5 to 8 seconds so the routine feels like real maintenance. A user watching the console sees a plausible tune-up running, which buys the malware time and lowers suspicion. The theater is the point, because the victim has already granted administrator rights by opening PowerShell elevated.
The real work hides in a function named Advanced-Optimization. The script disables TLS certificate validation, confirms it is running with administrator privileges and exits if not, then creates the directory C:\Windows\Background and adds that path to Microsoft Defender exclusions. It opens a temporary Windows Firewall rule permitting outbound connections to msfconfig[.]icu on TCP port 443, downloads the XMRig payload from that host, validates the executable, and moves it to C:\Windows\Background\system.exe. Every step is designed to blend into a Windows directory and to blind the built-in antivirus before the miner ever launches.
Persistence Built for the Long Haul
Cryptomining only pays if it runs continuously, so the script invests in persistence. It stops any existing scheduled task named XMRig-[computer name] and terminates running xmrig processes first, a housekeeping step that also suggests reinfection or version updates are part of the operator's plan. It then creates a fresh scheduled task, XMRig-[computer name], configured to run system.exe with SYSTEM privileges on every startup. Running as SYSTEM means the miner survives user logout, restarts cleanly, and sits above the permission level of the account that installed it.
This is the detail that should worry defenders more than the mining itself. An attacker who can get SYSTEM-level scheduled task persistence and a Defender exclusion on an endpoint owns that endpoint. Today the payload is XMRig, which is noisy and mostly costs the victim electricity and performance. The identical delivery chain can swap system.txt for an infostealer that harvests browser tokens and session cookies, or a loader that stages ransomware. The cryptominer is the least damaging thing this access could deliver, and that is the case for treating any confirmed infection as a full compromise.
Why This Beats Endpoint Controls
ClickFix works because it inverts the usual security model. Most endpoint defenses assume malicious code arrives without the user's cooperation, so they scrutinize downloads, email attachments, and exploit behavior. Here the user opens an elevated shell and voluntarily executes the command, which many controls interpret as authorized administrative activity. The Defender exclusion on C:\Windows\Background then removes the payload directory from scanning before the executable lands. By the time anything runs, the tooling that should have caught it has been told to look away, by an administrator, on paper.
For enterprise environments, the mitigations are structural rather than clever. Constrained Language Mode for PowerShell, blocking or logging clipboard-to-console paste behavior, and restricting who can run elevated shells all raise the cost of this technique. Endpoint detection that alerts on new Defender exclusions, on scheduled tasks created to run from C:\Windows\Background, and on outbound connections to freshly whitelisted firewall destinations will catch the behavioral fingerprint even when the payload changes. The lesson we would carry to a security team is to monitor the enabling actions, because the exclusion and the scheduled task are far more stable indicators than any single miner binary.
Cleaning Up and Confirming Nothing Else Landed
For anyone who ran one of these commands, the checklist is specific. Look for the C:\Windows\Background directory, inspect Microsoft Defender exclusions for that path, and search scheduled tasks for entries beginning with XMRig-. If found, remove the scheduled task, delete the Defender exclusion, delete the folder, and run a full antivirus scan. Given the SYSTEM-level access the script obtained, a clean operating system reinstall is the only response that fully rules out additional persistence the miner routine may have staged, and for a machine that touched corporate credentials that higher bar is the right call.
The remediation should not stop at the one host. Because the access level allowed credential theft, any accounts used on the infected machine should be treated as exposed and rotated, and session tokens invalidated. The Defender exclusion is a reminder that the attacker had the opportunity to disable protection for other paths too, so a thorough scan needs to look beyond the named directory. We would document each infected endpoint as a potential pivot rather than an isolated nuisance, because the miner is the visible symptom of full control, not the extent of it.
The Governance Angle for CxOs
This campaign targets gamers, and that framing can lull enterprise leaders into filing it under consumer risk. We would resist that. ClickFix is a delivery pattern, and the same script that reaches a gamer through a Steam forum reaches an employee through a fake CAPTCHA, a bogus meeting-fix prompt, or a spoofed IT support message. The workforce that runs administrator PowerShell to fix a game is the same workforce that will run it to fix a laptop, especially when the instruction looks authoritative. Security awareness training that never names this specific move, paste-and-run from an elevated shell, leaves the exact gap the technique exploits.
The durable defenses are policy decisions a CISO or CTO can make now. Remove standing local administrator rights from users who do not need them, enforce PowerShell logging and Constrained Language Mode, and alert on the behavioral indicators this campaign leaves behind. Pair that with a plain instruction to every employee: no legitimate fix ever requires pasting a stranger's command into an administrator terminal. The technical controls and the human rule reinforce each other, and together they turn a one-click compromise back into the multi-step problem it should be for the attacker.
