Steam Forum Users Are Hijacking Help Threads And Tricking People Into Installing Malware

Published Jul 31, 2026, 10:20 AM EDT James Lucas is an Executive Editor at TheGamer who has worked in professional journalism since 2018. A Newcastle University graduate with a degree in Journalism, Media, and Culture, they have written hundreds of guides, news stories, and original reports, with bylines in IGN, NME, GaymingMag, and VG247, sourcing interviews with studio heads, legendary industry figures, prominent actors, and more. An expert on FPS games, Soulslikes, RPGs, and survival horror, James has intimate knowledge of a wide variety of titles, providing in-depth coverage and exclusive profiles. Some of the games they have extensively covered include: Half-Life 3, Counter-Strike, Elden Ring, and Fallout. They pride themselves on their consistently thorough research, leveraging nearly a decade of industry experience. You can reach them at James.t@thegamer.com Sign in to your TheGamer account Bad faith actors using Steam as a vehicle to peddle malware is nothing new. We constantly see Workshop mods and games designed as trojans to install harmful software on players’ computers, with Meccha Chameleon even falling victim recently after investigating claims of illicit maps, losing access to its official Discord server in the process. But now, these bad-faith actors are spilling out onto the Steam Forums, hijacking help threads to install cryptominers on users’ computers. As reported by Bleeping Computer, it’s a simple setup: someone posts about a broken install, their game crashing, or some other technical problem — looking to the community for help — and then a scammer tells them to open PowerShell as an administrator and paste in a command. That command quietly installs an XMRig executable, secretly planting the cryptominer on their hardware. It’s known as a ClickFix attack, requiring both administrator privileges and user input to work. So, it needs to be believable, and when presented as the solution to a technical problem on the Steam Forums, it’s easy for a scammer to dupe unsuspecting players into downloading the software. To that end, it displays fake errors, verification prompts, and troubleshooting instructions that appear genuine, while working behind-the-scenes to bypass security protections and install malicious code. What Is A Cryptominer? Via BleepingComputer. Cryptominers are exactly what they sound like: software that uses your computer to earn newly minted coins. Leveraging your GPU and CPU, they run in the background to constantly trial and error the calculations required to 'mine' cryptocurrency, meaning that a more powerful rig can make more attempts. Hence why scammers are targeting the Steam Forums. People do use cryptominers legitimately to earn digital currency, but scammers like these target unsuspecting users to hijack their computer and siphon their power without paying a cent. After all, it’s a pretty intensive operation, demanding increased electricity use that the victims will be forced to pay, while the scammer runs off with the profits. Once you've entered the command, it will create a temporary outbound Windows Firewall rule that allows for the cryptominer download, which is then moved to the Windows background folder, ensuring it launches every time your computer starts. While you can run antivirus checks to weed out the cryptominer, it's safer to reinstall your entire operating system as you can never be sure what other malware may have been planted during the installation. Really, the best advice is that you should never run a PowerShell command provided by strangers on the internet.