Threat Brief — 2026-07-26 — ClickFix on Steam, Windows activation closed
Two fresh items landed in the last four hours. The more actionable of the pair is a live social-engineering campaign abusing Steam discussion forums to push XMRig cryptominers via the now-ubiquitous ClickFix technique — worth a heads-up to any teams with users on the platform. The second is a Microsoft licensing change: corporate Windows activation is being tied to hardware for the first time, closing the long-standing loophole that let org keys float freely between machines. Neither rises to critical, but the Steam campaign is actively infecting users today.
Top items
- Steam forum ClickFix campaign drops XMRig on gamers. Attackers are posting in Steam discussion forums disguised as fixes for game or computer problems, using fake "fix" prompts (the ClickFix pattern) that ultimately deploy XMRig cryptominers. The attack surface is any user who reads and follows forum instructions — a broad, low-friction vector. No CVE or exploit tag is associated, but the campaign is live and actively infecting devices. (src: BleepingComputer)
- Microsoft closes main Windows activation loophole; corporate activation tied to hardware. For the first time, corporate Windows activation will be bound to the physical machine, eliminating the ability to reuse organisational activation keys across disparate hardware. This is primarily a licensing/compliance development rather than a direct security vulnerability, but it will disrupt grey-market key resellers and may change how IT teams handle hardware refresh cycles. (src: SecurityLab.ru)
Themes
ClickFix goes gaming. The ClickFix social-engineering pattern — where attackers present fake error/captcha prompts that trick users into running pasted commands — continues to expand into new communities. We've seen it in malvertising and fake-software contexts recently; Steam forums represent a natural evolution because the audience is conditioned to seek community troubleshooting help. Expect this pattern to keep spreading across platforms where users expect to copy/paste instructions.
===