TerminalFix: The ClickFix Variant That Hands Attackers Your Entire Network

Microsoft has published a breakdown of a new attack campaign called TerminalFix, and it's a fairly nasty piece of work. It's a variant of the ClickFix social engineering technique, which tricks users into manually running malicious commands on their own machines. The twist here is that instead of pointing victims at the Windows Run dialog like most ClickFix campaigns do, TerminalFix steers them toward Windows Terminal or PowerShell directly. That's not a trivial distinction. Multi-line scripts are far more likely to execute cleanly in those environments, which makes the whole operation more reliable from an attacker's perspective.

The initial hook is a fake Cloudflare CAPTCHA served through compromised websites. Visitors see what looks like a routine bot verification check and are prompted to copy and run a PowerShell command to 'prove' they're human. It's a well-worn trick, but it keeps working because people are conditioned to trust CAPTCHA prompts.

From there, things escalate quickly. The PowerShell command fetches a ZIP file containing a legitimate Windows binary alongside a rogue DLL. The legitimate binary is used to sideload the malicious DLL, a classic technique for bypassing application allowlists. That sideloaded DLL then reaches out to external domains to pull down additional payloads hidden inside PNG image files using steganography. Hiding malware inside images is a neat way to slip past network monitoring tools that are scanning for obviously suspicious file types.

Once the steganographic payloads are extracted, the malware digs in. It establishes persistence through Registry Run keys and scheduled tasks, then conducts Active Directory reconnaissance: domain trust mapping, admin enumeration, and internal network topology discovery via targeted pings. The attackers want a full picture of what they've landed in before doing anything else.

The centrepiece of the whole operation is a Python-based reverse tunnel implant. It creates an encrypted WebSocket connection back to attacker-controlled infrastructure and allows the C2 server to reach any host the infected machine can see on the internal network. Essentially, the compromised endpoint becomes a proxy into the organisation's private network. That's the bit that should worry security teams most.

Rounding things out is a persistent PowerShell file-watch loop that polls a text file for new commands, executes them, and logs the output. It's a simple but effective way to maintain post-compromise control without anything particularly exotic.

Microsoft's guidance for defending against this is broadly sensible: lock down PowerShell and Run dialog access for standard users via AppLocker or Group Policy, enable PowerShell script block logging, watch for DLL sideloading indicators, and make sure staff know what ClickFix attacks look like. None of that is revolutionary advice, but it would blunt most of TerminalFix's early-stage effectiveness.

The uncomfortable reality is that the initial compromise here relies almost entirely on a user doing something they were socially engineered into doing. The technical sophistication comes later. Which means the most important control is probably the one organisations spend the least time on: teaching people to be sceptical of anything that asks them to run commands they don't understand.