A new ClickFix-style social engineering technique is raising the stakes for defenders because it does not rely on a traditional malware attachment or drive-by exploit. Instead, Microsoft says a variant it tracks as TerminalFix pushes users toward Windows Terminal or PowerShell and persuades them to run an attacker-supplied command under the guise of completing a Cloudflare verification check.

The practical lesson is straightforward: any web page that asks a user to copy a command into Windows Terminal, PowerShell, or the Run dialog should be treated as hostile until proven otherwise. CAPTCHA systems do not require visitors to paste scripts into local shells. TerminalFix abuses that trust gap to convert a fake browser prompt into hands-on-keyboard code execution on the victim endpoint.

What makes TerminalFix different

ClickFix campaigns typically present a fake error, update prompt, or verification step and tell the user to paste a command into the Windows Run dialog. TerminalFix keeps the same social engineering foundation but shifts the execution target to Windows Terminal or PowerShell. That matters because a shell is more tolerant of complex, multi-line commands and can make it easier for an attacker to stage downloads, unpack archives, and launch follow-on scripts in one user-driven sequence.

According to Microsoft’s analysis as reported by The Hacker News, the campaign begins on compromised websites that display fake Cloudflare CAPTCHA pages. The victim is instructed to copy and execute a PowerShell command. From there, the attack chain moves into a multi-stage process involving a downloaded ZIP archive, a legitimate executable, a malicious DLL, hidden payloads, reconnaissance, persistence, and a reverse-tunnel implant.

This blend of social engineering and living-off-the-land execution is why the campaign deserves attention from security teams. The first step may look like a user mistake, but the post-execution behavior resembles a serious enterprise intrusion.

How the attack chain unfolds

Microsoft observed the malicious PowerShell command retrieving a ZIP file that contains a legitimate Windows-related binary named LockScreenContentServer.exe and a rogue DLL named dui70.dll. The pairing is used for DLL sideloading: the trusted executable runs, but it loads the attacker-controlled DLL from the same working directory or expected search path.

After that, the sideloaded DLL retrieves additional payloads concealed inside PNG images from attacker-controlled infrastructure. This use of steganographic delivery can make network and file inspection harder because defenders may initially see image files rather than obvious executables or scripts. The campaign then establishes persistence using Registry Run keys and scheduled tasks.

The intrusion does not stop at persistence. The payload performs domain and network reconnaissance, including system metadata collection, domain trust discovery, domain administrator enumeration, Active Directory user and computer searches, and connectivity checks against named servers to infer internal topology. These actions are consistent with an operator preparing to understand where the compromised machine sits inside the organization.

The most concerning stage is the Python-based reverse-tunnel backdoor, identified in the report as client.py. Rather than simply beaconing for commands, the implant can tunnel arbitrary TCP traffic through an encrypted WebSocket channel to attacker-controlled infrastructure. In practical terms, the compromised endpoint can become a bridge into systems that are reachable from inside the victim network but not exposed to the public internet.

Why reverse-tunnel access is high impact

A reverse tunnel changes the defender’s risk model. If an attacker can proxy traffic through an enrolled workstation, they may be able to reach internal web apps, file services, management interfaces, development systems, or identity infrastructure that would otherwise be protected by perimeter controls. That access can support credential theft, privilege escalation, lateral movement, data staging, and ransomware deployment.

This is the distinctive defensive point: TerminalFix is not only a fake CAPTCHA nuisance; it is a potential internal network pivot delivered through user-assisted PowerShell execution. Security teams should treat confirmed execution as more than commodity malware cleanup. The right response includes endpoint containment, credential review, internal reachability analysis, and hunting for related persistence and reconnaissance artifacts.

Defensive actions to prioritize

Organizations should start with user-facing controls. Train employees that real CAPTCHA checks never require running commands in PowerShell, Windows Terminal, Command Prompt, or the Run dialog. Help desk scripts and security awareness material should call out the exact pattern: “copy this command, open a terminal, paste it, and press Enter.” That sequence is the red flag.

On the technical side, restrict PowerShell and script execution for standard users where operationally possible. Microsoft recommends controls such as AppLocker, Application Control for Windows, and Group Policy. Teams that cannot broadly block PowerShell should at least enforce constrained language mode where appropriate, require script signing for administrative workflows, and limit interactive shell access on high-risk user groups.

Enable PowerShell script block logging, module logging, and command-line auditing so pasted commands are visible during investigation. Monitor for encoded or obfuscated PowerShell, downloads followed by archive extraction, and unusual child processes launched from Windows Terminal or PowerShell. Because TerminalFix uses DLL sideloading, defenders should also alert when legitimate binaries execute from user-writable or temporary directories while loading unexpected DLLs nearby.

Persistence hunting should include Registry Run keys, scheduled tasks created around the suspected compromise window, unusual Python execution, and file-watch loops that read commands from one text file and write output to another. Network detection should look for workstations initiating encrypted WebSocket-style outbound sessions to uncommon domains, especially when those sessions persist or coincide with internal scanning behavior.

Finally, incident responders should assume that reconnaissance data may have been collected. Review Active Directory queries, domain trust enumeration, privileged group lookups, and internal host probing from the affected endpoint. If evidence shows reverse-tunnel activity, rotate credentials used on the host, review privileged logons, and investigate reachable internal systems for follow-on access.

TerminalFix works because it converts user trust into shell execution. Reducing that risk requires both education and hard controls: make the fake CAPTCHA instruction recognizable to users, then make it difficult for a single pasted command to become a durable foothold.

Source: The Hacker News report