Threats · 43 days ago
Microsoft Threat Intelligence says the TerminalFix ClickFix campaign is active, using a fake Cloudflare CAPTCHA on compromised sites to trick victims into pasting a malicious PowerShell command in Windows Terminal or PowerShell. Microsoft says that shift from the Windows Run box makes long, multi-line scripts more likely to run as intended.
The chain goes well beyond a one-off lure: the initial command downloads a ZIP file, sideloads a malicious DLL, pulls hidden payloads from PNG images, sets persistence with registry Run keys and scheduled tasks, and launches a reverse-tunnel implant. That gives the attacker encrypted TCP tunneling and internal reconnaissance from the compromised host, so the machine can become a proxy into the network instead of just an infostealer victim.
For defenders, the important point is where the compromise lands: on Windows endpoints where users can open Terminal or PowerShell, the browser lure becomes an admin-tool delivery path. Microsoft did not see the later hands-on-keyboard steps in the chain it analyzed, so the remaining question is how often this pivot is being used for follow-on access in real environments.
5 sources covering this story
'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks
The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations' networks.
Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines
Next-level ClickFix wave sets off multi-stage attack chain
Microsoft warns of TerminalFix attacks deploying reverse tunnels
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal.
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Microsoft says TerminalFix uses fake Cloudflare CAPTCHAs to trigger PowerShell and deploy a reverse-tunnel backdoor for internal network access.
TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog
Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.
Part of the PlainSec briefing for 2026-09-01