A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal.
Unlike typical ClickFix attacks that often lead to infostealer malware infections, this campaign uses a multi-stage intrusion chain that ultimately gives attackers a reverse tunnel into the victim’s internal network.
TerminalFix differs from normal ClickFix attacks in that it directs users to Windows Terminal or PowerShell, which enables successful execution of more complex, multi-line scripts.
Microsoft discovered the attacks in the wild but did not observe hands-on activity. However, the researchers warn that access obtained this way could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or deploying ransomware.
The infection begins with a fake CAPTCHA prompt that instructs victims to execute a PowerShell command preloaded into the clipboard as part of the purported verification process.
.jpg)
Source: Microsoft
The command downloads a ZIP archive that contains a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory.
For the second stage, the threat actor used steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads the image files from the command-and-control (C2) server and reassembles the embedded payloads on the disk.
Source: Microsoft
The malware establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour.
While active, it performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory (AD).
The most important component is a custom Python reverse-tunnel module that connects to an outbound address (gitnow[.]dev:443 ) over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying.
This allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim.
Source: Microsoft
The reverse-tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown.
Microsoft says this can turn the infected endpoint into a network pivot, giving the operator a route to systems discovered during the earlier AD and network reconnaissance operation.
The researchers recommend restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its normal path, and hardening browsers and endpoint protections.
If compromise is confirmed, it is advisable to investigate for lateral movement and to rotate credentials, including domain admin credentials, if accessible from the infected host.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
