Steam users are being warned about a dangerous new scam spreading through the platform’s community forums. Instead of exploiting a software vulnerability, the attack relies on convincing users to voluntarily run malicious PowerShell commands with administrator privileges.
Once those commands are executed, attackers can silently install a persistent cryptocurrency miner that continuously uses a victim’s PC to generate digital currency.
Steam Forum Posts Trick Users Into Running PowerShell Commands
The scam starts with seemingly helpful forum posts that claim to offer a solution for Windows performance problems or game optimization.
Victims are instructed to launch Windows PowerShell as an administrator and paste a series of commands into the console. While the instructions may appear harmless, they actually download and install malicious software from a remote server.
Because users willingly grant administrator permissions, Windows treats the installation as an authorized action.
Fake Windows Optimizer Hides the Real Threat
To avoid raising suspicion, the malware disguises itself as a Windows optimization utility.
During installation, it displays fake progress messages and other visual cues that make it appear as though the system is being cleaned or optimized. In reality, the program is installing a cryptocurrency miner in the background.
This social engineering tactic makes users believe the software is legitimate while the malware quietly completes its installation.
Miner Survives Reboots and Uses System Resources
After installation, the malware creates a startup task that automatically launches every time Windows boots.
The persistent miner continuously consumes CPU and other hardware resources to mine cryptocurrency for the attackers. Victims may notice:
- High CPU usage
- Slower overall system performance
- Increased power consumption
- Higher system temperatures
- Loud or constantly running cooling fans
Reports also suggest the malware can be difficult to remove because it uses administrator privileges to establish persistence.
Administrator Rights Help the Malware Evade Security
One of the biggest dangers comes from granting PowerShell administrator access.
With elevated permissions, the installer can make system changes that would normally be blocked. Security tools, including Windows Defender, may have a harder time detecting or stopping the malware once it has been installed.
The attack doesn’t rely on exploiting a flaw in Steam or Windows. Instead, it exploits user trust and encourages victims to perform the installation themselves.
How the Steam Scam Works
The attack follows a straightforward chain:
- A scam post appears on the Steam forums.
- Users are told to run PowerShell as an administrator.
- Malicious commands download a fake Windows optimization program.
- Fake installation screens hide the real activity.
- A cryptocurrency miner installs in the background.
- A startup task ensures it launches every time Windows starts.
- The miner continuously consumes system resources.
Steam Users Should Never Run Unknown PowerShell Commands
This campaign serves as another reminder that attackers increasingly rely on social engineering instead of technical exploits.
If someone on a Steam forum, Discord server, Reddit thread, or any other community tells you to copy and paste PowerShell commands into an elevated terminal, treat the instructions as suspicious unless they come from a trusted and verified source.
Running unknown commands with administrator privileges can give attackers complete control over your PC, making prevention far easier than trying to remove persistent malware afterward.
