Microsoft Warns of TerminalFix ClickFix Attack Using Reverse Tunnels

A new ClickFix malware campaign dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands through Windows Terminal.

Unlike many ClickFix attacks that primarily deliver infostealers, TerminalFix deploys a multi-stage intrusion chain designed to establish persistence, conduct network reconnaissance, and provide attackers with a reverse tunnel into the victim’s internal network.

The campaign also differs from typical ClickFix infections by directing users to Windows Terminal or PowerShell. This allows the attackers to execute more complex, multi-line commands and scripts than those commonly used in browser-based social engineering attacks.

Microsoft identified the TerminalFix activity in the wild but did not observe evidence of successful follow-on activity. Security researchers warn that access gained through this attack could enable lateral movement, privilege escalation, credential theft, security tool evasion, data theft, or ransomware deployment.

Fake CAPTCHA prompts deliver malicious PowerShell commands

The attack begins when a user visits a compromised website and encounters a fake CAPTCHA verification window. The prompt instructs the victim to copy and execute a PowerShell command that has been secretly placed on the clipboard.

The command downloads a ZIP archive containing a legitimate, digitally signed executable alongside a malicious DLL. The malware then decodes the obfuscated payload and launches it directly in memory, helping the attack evade traditional file-based detection.

Steganography hides malware inside PNG images

During the second stage, the attackers use steganography to conceal executable files and DLL fragments within the pixel data of three PNG images. A script downloads the images from a command-and-control (C2) server and reconstructs the embedded payload on the victim’s disk.

TerminalFix establishes persistence by creating a scheduled task that runs every hour, as well as a registry-based execution key. These mechanisms allow the malware to restart after reboots and maintain access to the compromised system.

TerminalFix performs network reconnaissance

Once active, the malware gathers system information and probes the environment for domain controllers, databases, backup servers, network gateways, mail systems, and other valuable infrastructure. It also enumerates Active Directory (AD) resources to identify potential targets for lateral movement.

The campaign’s most significant component is a reverse tunneling module that connects to Gitenau[.]Development:443. The component supports SOCKS5-style TCP proxying over encrypted WebSockets.

This functionality allows the attacker to instruct the compromised computer to connect to an internal IP address, hostname, and port that are reachable from the victim’s network.

The reverse tunnel supports multiple connections over a single WebSocket through multiplexing. It also includes features such as rotating browser-like user-agent strings, keepalive messages, and remote shutdown capabilities.

Microsoft says the malware could turn an infected endpoint into a network pivot. This would give attackers a pathway to systems identified during earlier Active Directory and network reconnaissance.

How to defend against TerminalFix attacks

Organizations should restrict and log PowerShell activity, monitor Windows Terminal usage, and investigate instances of LockScreenContentServer.exe running from unusual or unauthorized paths. Security teams should also strengthen browser protections, endpoint detection, and phishing awareness training.

Users should never paste commands into PowerShell or Windows Terminal at the direction of a website, including a page displaying a CAPTCHA or security verification prompt.

If a TerminalFix compromise is suspected, security teams should investigate potential lateral movement, review access to internal systems, and rotate exposed credentials. Domain administrator credentials should also be changed if they may have been accessible from the infected host.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report