Microsoft has revealed details of a new cyber threat known as TerminalFix, a variant of ClickFix, which deceives users into executing harmful commands in Windows Terminal or PowerShell. Unlike previous ClickFix campaigns that targeted the Windows Run dialog, this approach directs users to Windows Terminal or PowerShell, facilitating the execution of complex scripts. This campaign affects organizations across various sectors by using compromised websites to present fake Cloudflare CAPTCHA verifications. These verifications encourage users to copy and run a malicious PowerShell command.
The attack unfolds through a sophisticated, multi-stage process involving DLL sideloading, steganographic payload extraction, and extensive Active Directory reconnaissance. The ultimate goal is to deploy a custom reverse-tunnel implant, granting attackers persistent network-level proxy access to the affected machine. Specifically, the malicious command downloads a ZIP file containing a legitimate executable and a harmful DLL, initiating a DLL sideloading attack.
The sideloaded DLL retrieves next-stage payloads hidden in PNG images from external domains. It establishes persistence, carries out domain reconnaissance, and deploys a Python-based reverse-tunnel command-and-control implant. This backdoor facilitates tunneling arbitrary TCP traffic back to attacker-controlled infrastructure, enabling the C2 server to access any network host visible from the victim's machine.
Microsoft warns that this form of intrusion is particularly perilous as it gives attackers direct access to an organization's internal network. This access can be exploited to escalate privileges, bypass security controls, steal sensitive data, and deploy ransomware, posing a significant threat to enterprise environments. To counter this threat, Microsoft advises restricting PowerShell and Run dialog execution for standard users, monitoring for DLL sideloading indicators, training employees to recognize ClickFix attacks, and enabling PowerShell script block logging to detect and analyze obfuscated commands.