Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.

BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people’s posts about games crashing, lost inventory items, and other technical issues.

The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.

These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.

Although ClickFix attacks require interaction from the victim, they are effective because they present users with what appears to be both a legitimate solution for a problem they are having.

Since the victim manually launches the command, the attack can also bypass some security protections that would otherwise automatically block executed malicious code.

Fake Windows optimization installs malware

The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named “msf utility \ PC Opt.”

When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker.

However, most of these functions do not perform the tasks they claim. Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate.

The actual malicious activity is hidden in a function named ‘Advanced-Optimization’, which first disables TLS certificate validation and checks that it is running with administrator privileges. If it is not, the script displays an error stating that administrator rights are required and exits.

Once running with elevated privileges, the script creates the ‘C:\Windows\Background’ directory and adds it as an exclusion to Microsoft Defender’s scanning functions.

It also attempts to stop an existing scheduled task named ‘XMRig-[computer name]’ and terminates matching processes named ‘xmrig’ or ‘system’ that are running from the installation directory. It also attempts to delete any XMRig configuration files stored as C:\Windows\Background\config.json.

It is unclear whether this cleanup is intended to remove leftovers from an earlier install of the same malware or another miner already present on the device.

The malware then creates a temporary outbound Windows Firewall rule allowing connections to ‘msfconfig[.]icu‘ over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file.

Before installing it, the script verifies that the downloaded file is not empty and is a valid executable. If so, it moves the file to C:\Windows\Background\system.exe.

So it launches every time Windows starts, it will create a new scheduled task named “XMRig-[computer name],” that launches the system.exe executable with SYSTEM privileges.

As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing.

Those who executed the command should check for the ‘C:\Windows\Background’ directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with ‘XMRig-‘.

If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds.

If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents.

Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Modern electric vehicles retain an average of 97 percent of their original range after three years and 95 percent after five years, according to a new analysis by EV data company Recurrent. For a 2026 model with a rated range of 325 miles, that means roughly 309 miles would remain after half a decade of driving. A separate Recurrent study found that the battery replacement rate for EVs built from 2022 onward is just three in every thousand vehicles.

A study from vehicle data company Geotab, drawing on more than 22,700 vehicles, reached a similar conclusion, finding an average annual degradation rate of just over two percent. Viet Nguyen-Tien, an EV researcher at the London School of Economics, told The Wall Street Journal that improvements in battery chemistry, thermal regulation, and battery-management systems have made today’s batteries far more durable than those in early-generation models like the Nissan Leaf, which developed a reputation for rapid degradation after its 2010 launch. In a 2026 AAA survey, 56 percent of people who said they were unlikely to buy an EV cited the high cost of repairing or replacing the battery as their top concern.

The data suggests that concern is increasingly unfounded, but it has not translated into sales. Cox Automotive estimates that Americans bought roughly 75,000 new EVs in June, down nearly 28 percent from a year earlier, giving electric vehicles just over five percent of total new-vehicle sales during the month. A Deloitte survey from earlier this year found that only seven percent of Americans want their next car to be electric, and used EV sales told a different story, rising more than 20 percent in June compared with the previous year, according to Cox Automotive.

The sales decline is largely a policy story. The Trump administration allowed the $7,500 federal EV tax credit to expire last September and rolled back emissions regulations, a shift that Ford CEO Jim Farley warned at the time could cut demand for EVs in half. Several automakers have since cancelled or paused EV models in the US market, and while Edmunds reported that rising gas prices had started nudging consumer interest upward earlier this year, the shift was not enough to reverse the broader trend.

The gap between what the technology can do and what consumers believe it can do is now the central obstacle for the American EV market. The batteries work, the replacement rates are negligible, and the used market is growing, but new sales are falling because federal policy removed the price incentive that made EVs competitive with combustion alternatives. Until that changes, the industry is left selling a product that has answered its biggest technical question to a market that either has not heard the answer or no longer has the financial reason to care.

Motorola has revealed the Moto Pad 70, a new mid-range Android tablet with a large display, stylus support, 5G connectivity, and a sizeable battery.

The tablet will launch in India on August 8 through Flipkart. Its 12.1-inch 2.5K display, included Moto Pen, 10,200mAh battery, and 68W charging give it several features that could appeal to people considering Apple’s base iPad. However, the mid-range Dimensity 6400 processor means it is unlikely to match the iPad in raw performance.

Could it be a cheaper iPad alternative?

Motorola appears to be competing on value rather than processing power. The 12.1-inch screen is larger than the display on Apple’s standard iPad, while support for up to 800 nits of brightness and wide DCI-P3 colour coverage should make it suitable for streaming, reading, and creative work.

The included Moto Pen adds to the tablet’s value. It supports pressure sensitivity, tilt detection, and palm rejection, giving buyers a ready-made setup for note-taking and drawing without another accessory purchase. Motorola will also offer a magnetic keyboard case for writing and lighter office work.

A 10,200mAh battery should help it last through long viewing or study sessions, while 68W charging is unusually fast for a tablet in this class. Motorola has managed to fit it into a 6.29mm body weighing 530 grams, so the large battery has not made it especially thick or heavy. Quad speakers with Dolby Atmos and 5G connectivity add to its appeal as an entertainment device.

Performance is where the Pad 70 lags behind

The Dimensity 6400 should be sufficient for browsing, streaming, video calls, note-taking, and everyday multitasking. It will struggle to compete with Apple’s chips in demanding games, video editing, creative apps, and heavier workloads.

Motorola is also promising only two major Android upgrades, although security updates will continue until 2030. The Moto Pad 70 closely resembles the Lenovo Idea Tab Plus, which launched last September for around 300 euros. Indian pricing is often lower than a direct conversion would suggest, so Motorola could position it comfortably below the base iPad.

At the right price, its large screen, included stylus, 5G support, and fast charging could make the performance trade-off easier to accept. Currently, it is unclear if the company plans to launch this tablet outside of India.

A hot potato: After introducing Windows 11, Microsoft forced the entire PC ecosystem to turn the Trusted Platform Module (TPM) into a standard component for every new motherboard or CPU. Now, Redmond is exploiting the now-pervasive device to further strengthen the Windows activation process in the enterprise market.

Microsoft recently announced a brand-new addition to Key Management Service (KMS), a standard feature for mass activation of Windows devices in enterprises and other large-scale organizations. The KMS feature will soon rely on hardware-based security, using TPM’s encryption “brain” to verify the legitimacy of the server hosting KMS data.

Redmond explained that attackers have traditionally abused KMS to spoof the activation process, which is both a security issue and a way for individual users to avoid paying for a new Windows license. The new “TPM-based attestation” option will use the TPM for verifying the cryptographic proof of the integrity of a KMS server.

TPM-based attestation will first check the hardware identity of the KMS host, proving that the server has been verified by Microsoft as a legitimate hardware device. Then, the feature will confirm that the KMS host has not been tampered with in any way. Finally, the TPM chiplet will let the now-verified KMS host manage the mass activation requests required by the organization.

TPM-based attestation will become a mandatory requirement for KMS activation starting with the next Windows Server release, Microsoft stated. The corporation will begin to pressure business customers by sharing its “readiness messaging” in Windows Server 2025, starting from August 2026. Sysadmins will need to adapt and prepare their organizations in time, checking whether their KMS infrastructure is ready for hardware-based activation security.

“As Windows security continues to evolve, trusted activation infrastructure will play an increasingly important role,” Microsoft stated. “KMS Hardware Secured helps position your environment for the future while aligning with Microsoft’s continued investment in hardware-rooted trust.”

Popular tools designed to activate pirate copies of Windows have used KMS-based methods for quite some time. In 2025, Microsoft stopped the workaround employed in the so-called “KMS38” activation method, although “pure” KMS activation should still work as expected.

The elusive Massgrave collective provides open-source tools for “unofficial” Windows activation procedures, including an Online KMS method that needs to “phone home” to a fake KMS server every six months. TPM-based attestation might very much be the end of Online KMS-based piracy, although we will have to wait and see how the story actually ends. Massgrave recently introduced the new TSforge Activation method, which can allegedly bypass Microsoft’s entire DRM architecture for software product activation.

EPISODE 14 The morning coffee in Mission Control is interrupted by a hesitant tapping at the door. Our current office temp has an issue.

“It’s the printer,” she says, apologetically. “It makes a noise.”

“When it’s printing, or all the time?” the PFY asks.

“Sort of both. It starts making the noise before it starts printing, then keeps making the noise for about 20 seconds after.”

The PFY and I pop out and take a look, and the printer is indeed making a tiny squeaking noise, from the time it wakes up until the time it lapses back into low-power mode.

“I know it’s hardly noticeable, but the office is so quiet…” she says.

“Leave it with us,” I say.

“So you can fix it?”

“A machine with an extortionately priced service contract, voided the moment we open a panel that we’re not authorized to open?” I ask. “Not a chance!”

“Oh,” she says, disappointedly.

“But what we can do,” I say, moving a bunch of paper from my rarely used desk phone and pressing a speed dial button, “is log a fault.”

Barely 15 minutes later, I have negotiated the tricky maze of passages, all alike, which comprise the printer company’s ancient IVR system, and am speaking to an actual engineer.

“… and what’s the serial number?” he asks.

I rattle off the sequence of numbers that I took a snapshot of earlier.

“Oh no, that sounds like the controller serial number,” he sighs. “I need the printer serial number. It’s on the back panel of the machine, underneath the sticker with our support number on it. If you want to ring back when you get that I ca-“

“It’s OK, I have that here,” I say, having been to this particular rodeo a time or two before.

Ploy #1 in the Printer Engineer playbook is to ask for the serial number. If the user actually has the serial number, ask for some other number, i.e. the FULL model number, the total page count, a 40-digit service number from the sticker – where the last two digits are mysteriously missing, etc. When they can’t supply it, get them to ring back, endure another 15 minutes of ambiguous and clunky IVR, and then hopefully get fielded to some other engineer.

I rattle off the new number, the model number, the revision number – which is helpfully located on the base of the machine. Like I said, not the first time we’ve ridden this bronco…

“And what seems to be the problem?” the engineer asks, unable to shake us.

“It’s probably the fuser unit,” I say.

“It’s probably the fuser unit, or it is the fuser unit?” he asks.

“I can’t be sure – I’m no printer scientist,” I admit. “Could you make it in this morning?”

Ploy #2. You can never make it when they want you to make it.

“Oh… this morning I’m fully booked up.”

“This afternoon then?” I ask.

“Let me see. Hmmm. No, it looks like I’ve got a couple of calls outside the city.”

“Tomorrow morning?”

“Hmmmmmmmmm, no, but I can possibly make it tomorrow between 1 and 3pm – if that works.”

“OK,” I sigh. “I suppose we can make that work.”

“And I’ll need a park for the van.”

“Right. I’ll get one coned off outside the building.”

…

“OK,” I say to the temp. “He’ll be here tomorrow at 3:45.”

“He said between 1 and 3,” she points out.

Ploy #3. Turn up late and leave a note asking the user to rebook.

We all know the rules.

… The next day, 3:40pm …

“And here he comes,” the PFY says, as we watch a small white van pull up beside the road cones we installed early this morning. The driver gets out, moves the cones, along with the “DANGER, SINK HOLE” sign that we had made – complete with branding from the local council.

Scant minutes later, he’s in the main office, looking at the printer.

“I thought you said it was a fuser unit?” he states.

“No, no, I said it was probably the fuser unit,” I counter.

“It’s got nothing to do with the fuser unit,” he replies.

“My bad,” I say. “But then would you have turned up if I’d told you it was a squeaky bearing?”

“Yes.”

“Yes, but would you then have said that you’d need to order some replacement bearings?”

“I do need to order some replacement bearings.”

“And in a week’s time, will you ring us back, say the bearings are discontinued, that this particular printer model is end of line, and that for the sake of compatibility we’d need to replace this printer and every other printer in the building for an eye-wateringly large price?”

Ploy #4. The Upsell.

“This printer model is end of line. We don’t have spares either,” he admits.

“So,” I say, “what I need you to do is this: take this printer up to the fourth floor, tell them that you’re upgrading their printer with this one, which has 32-bit color, blacker blacks, a memory expansion, and an advanced feeder mechanism – then bring their one down here.”

“It’s the same printer,” he replies. “They’re all exactly the same.”

“Yes, but only you, me, my assistant – and now our temp – know this.”

“No, I don’t think I could do th-“

“20 quid,” I say, waving a note in his eyeline.

“Be back in five,” he says, pocketing the cash faster than a FIFA official.

True to his word, he’s back in five, pushing a printer in front of him.

“Pleasure doing business with you,” he says, parking the printer in front of me and grabbing his tool kit.

…

“Are you sure that he actually replaced the printer?” the temp asks, as the PFY wheels the printer out of the main office to Mission Control. “Only, our printer had a red smudge on the front panel… and I think the replacement printer did too.”

Ploy #5. Take the money and run.

“We’ll only know by listening,” I say.

“Listening for what?” she asks.

“Shh!” I whisper.

And the temp’s right, the office is quiet. So quiet you could hear a slight squeaking noise from a worn bearing. Or, off in the distance, the sound of a large multifunction printer hitting a small white van from a great height…

• Ukraine Central Research Institute has unveiled Marichka, a closed neural network intended to cut brigade-level planning decisions from six to 12 hours down to minutes
• The system calculates force ratios, estimates losses, and models courses of action on an interactive map, but has so far only been trialed on test data, with classified document integration still pending
• Marichka adds another layer to Ukraine’s tech stack for battlefield planning: the country already fields Delta for situational awareness and works with Palantir at multiple levels

Ukraine’s Central Research Institute of the Armed Forces has presented Marichka, a closed neural network designed to compress the operational planning cycle at brigade level and above from hours to minutes.

The system, still in testing, is built to collect and verify battlefield information, then calculate force ratios and estimate required resources and likely losses, presenting commanders with modeled options on an interactive map. Military standards currently allow a regiment or brigade commander six to 12 hours and roughly 20 documents to reach the same point.

Now seems like a good time to revisit the recent Chess Records 75th Anniversary Series audiophile reissue of Chuck Berry’s 1959 one-LP masterpiece, Chuck Berry Is on Top. With one of Mr. Berry’s most famous musical progeny, the Rolling Stones, back on the charts with their very strong Foreign Tongues LP, newer fans discovering the glories of good old rock ’n’ roll would be wise to take a very enjoyable history lesson with Berry’s iconic third studio album.

Related Reviews:

For those unfamiliar with the Stones’ deep repertoire, they covered numerous Chuck Berry songs over the years, and much of their musical style, especially early on, was influenced by his writing and overall sound. Their versions of “Carol,” “Little Queenie,” “Around and Around,” and “You Can’t Catch Me” made that debt rather difficult to miss.

Effectively a greatest-hits collection in all but name, most of the tracks on Chuck Berry Is on Top were originally issued as 45 rpm singles during the late 1950s. Many became Top 40 hits, including “Almost Grown” (No. 32 on the Billboard Hot 100, No. 3 on the R&B chart), “Carol” (No. 18 Hot 100, No. 12 R&B), “Maybellene” (No. 5 Hot 100, No. 1 R&B), “Sweet Little Rock and Roller,” “Johnny B. Goode” (No. 8 Hot 100, No. 2 R&B), “Little Queenie” (No. 80 Hot 100), “Jo Jo Gunne,” “Roll Over Beethoven” (No. 29 Hot 100, No. 2 R&B), and “Around and Around.”

In terms of sound quality, this new reissue of Chuck Berry Is on Top is exemplary. The project was supervised by Chad Kassem of Analogue Productions, a division of Acoustic Sounds. Disc mastering and lacquer cutting were handled by Matthew Lutthans at The Mastering Lab, located within Quality Record Pressings (QRP), where the albums were manufactured.

Much like an Acoustic Sounds or Blue Note Tone Poet Series reissue, Chuck Berry Is on Top is packaged in a deluxe, expanded, laminated gatefold cover, rather than the single-pocket, flat-matte design of the original. Each disc is housed in an audiophile-grade, plastic-lined inner sleeve. The iconic black Chess Records label design has also been reproduced. Some original pressings used a blue label, but it is still a very cool detail.

For those dead set on finding an original 1959 copy of Chuck Berry Is on Top, tempered expectations may be in order, as copies in good condition remain quite rare. At the time of writing, only eight are listed on the vinyl marketplace Discogs, none graded higher than VG, with asking prices ranging from $35 to $185. It took me forever to find an original copy in playable condition out in the wild, so unless you are willing to pay collector prices, be prepared for a very long search.

That said, the prospect of buying a pristine new 180-gram pressing of Chuck Berry Is on Top, made from the original monaural master tapes and supervised by one of the most highly regarded vinyl production teams in the world, for $38.98 at Amazon seems like the logical choice for most fans.

Were the cover on my original copy not quite so nice, I might purge it entirely, knowing that this new Chess Records 75th Anniversary Series audiophile reissue will be my go-to listening copy for the foreseeable future. It sounds excellent and remains very much in keeping with the character of my original, minus the clicks and pops, of course. Perhaps it will become your go-to copy as well.

Our Ratings

★★★★★★★★★★ Music

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Pressing Quality

Where to buy:

Mark Smotroff is a deep music enthusiast / collector who has also worked in entertainment oriented marketing communications for decades supporting the likes of DTS, Sega and many others. He reviews vinyl for Analog Planet and has written for Audiophile Review, Sound+Vision, Mix, EQ, etc.  You can learn more about him at LinkedIn.

Related Reading:

IBM expects HRL’s technical breakthroughs will help drive its quantum programme for ‘decades to come’.

IBM is acquiring Boeing and General Motors’ jointly-owned research and development institute HRL Laboratories.

HRL’s expertise in silicon-spin qubit engineering is expected to help IBM in its long-term quantum plans. The lab was established in 1948 as Hughes Research Laboratories by the late prominent aviation expert Howard Hughes. Details of the transaction were not disclosed.

IBM has major ongoing quantum computing projects, including a roadmap to delivering Quantum Starling by 2029, expected to be fault-tolerant and 20,000-times more powerful than today’s quantum computers – capable of running 100m quantum operations.

As per IBM’s plans, Starling will be followed up with an even more powerful quantum computer called Blue Jay, projected to be capable of 1bn quantum operations.

In May, the company pledged more than $10bn to quantum research over the next five years and announced ‘Anderon’, the world’s first pure-play quantum wafer foundry in the making, with support from the US government.

The acquisition gives IBM a boost in quantum research and allows the incoming team from HRL to partner closely with Anderon to scale quantum manufacturing and enable faster learning cycles. Quantum technology has the potential for commercial impact across industries, including in life sciences, defence and navigation, according to IBM.

HRL’s support could also allow IBM to innovate and industrialise new technologies such as quantum sensing, and conduct deeper research into the sensors detecting and capturing subtle measurements.

Combined with additional technical capabilities in cryogenics, control electronics, qubit interconnects and packaging, IBM anticipates the acquisition will fuel its quantum programme for “decades to come” and help develop next-generation computing, communications and mission-critical systems.

HRL has also innovated in quantum materials that have the potential to unlock better semiconductors and more sensitive sensors.

“The HRL team will help IBM push even farther forward toward the frontiers of quantum innovation,” said Jay Gambetta, IBM’s director of research and an IBM fellow.

“This talented group of researchers brings a broad portfolio of technologies that will strengthen IBM’s long-term plans to deliver useful quantum computing to the world, bringing together advances across quantum computing, quantum sensing and quantum networking to enable the applications of the future.”

The announcement comes after a disappointing quarter for IBM, which reported a 1pc revenue growth and a marginally lower net income compared to the same quarter last year. The company lowered its 2026 forecast as a result.

“Joining IBM is the natural next chapter for what we have built at HRL, where our team has dedicated years to exploring paths to how future quantum computers could be built at scales that today seem impossible,” said Rob Vasquez, the president and CEO at HRL.

“We now look forward to leveraging IBM’s industry leadership and working alongside their world-class talent on fundamental infrastructure to take this vision forward.

“Additionally, our cutting-edge physical and information science innovations will combine with their advanced research capabilities to deliver an unmatched suite of technology solutions for our commercial and government customers.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.