What happened (and why you should care)

Microsoft researchers uncovered a sneaky new twist on the old ClickFix trick — this one’s nicknamed TerminalFix. Instead of nudging victims to hit the Windows Run box, attackers coax people into copying a multi-line command into Windows Terminal or PowerShell. The lure? A bogus Cloudflare-style CAPTCHA served from compromised sites that convinces visitors to paste and run the command. It sounds silly until a machine in your network becomes a literal tunnel for attackers.

This campaign targets organizations across industries and is anything but a one-off prank. Once the user runs the command, a chain of events unfolds that can quietly hand an attacker access to internal systems and let them poke around the network at will.

How the attack works (and what to do about it)

The steps are layered and clever — think kitchen-sink intrusion techniques mashed together:

  • Victim runs the scripted command in Terminal/PowerShell, which downloads an archive containing a legitimate-looking EXE and a malicious DLL.
  • The EXE is used to load the rogue DLL via DLL sideloading, letting the attacker run code under the guise of a trusted binary.
  • The malicious DLL fetches further payloads that are hidden inside image files (steganography), installs persistence via Registry Run keys and scheduled tasks, then performs deep Active Directory reconnaissance.
  • Eventually a Python-based implant (a backdoor) is deployed that opens an encrypted WebSocket to attacker infrastructure and sets up a reverse tunnel, allowing arbitrary TCP traffic to be proxied through the compromised host.
  • The attack also drops a PowerShell loop that watches a file for commands, runs them with Invoke-Expression, and writes back results — old tricks, still effective when paired with user help.

The reconnaissance phase collects system metadata, enumerates domain trusts and admin accounts, searches AD for user and computer objects, and even pings internal servers to map the network. In short: once inside, attackers can find and reach other machines from within your perimeter.

This is dangerous because the implant doesn’t just steal a file or two — it effectively punches a hole into your internal network that attackers can use to move laterally, escalate privileges, disable protections, exfiltrate data, or deploy ransomware.

Practical defenses (do these, and do them soon):

  • Block or restrict PowerShell and Run-dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy.
  • Consider blocking or auditing the Windows Run dialog (Win+R) if it’s not essential in your environment.
  • Enable PowerShell script block logging and module logging to catch obfuscated or encoded payloads.
  • Monitor for signs of DLL sideloading — unusual DLLs next to signed binaries, unexpected parent-child process relationships, and new Run keys or scheduled tasks.
  • Train staff to treat copy-paste prompts from random CAPTCHAs or “fix” pages as suspicious — social-engineering hygiene is still a top defense.
  • Harden AD privileges and monitor domain enumeration activity so reconnaissance trips are noisy and detected early.

Short version: don’t paste weird commands into Terminal, watch for odd CAPTCHAs, and lock down scripting and DLL loading as part of your defensive diet. This strain combines multiple persistence and evasion tricks, so prevention and early detection are your best friends.