A ClickFix Variant Built for Windows Terminal
Microsoft has disclosed a new attack campaign it calls TerminalFix — a variant of the "ClickFix" social-engineering technique that, instead of directing victims to the Windows Run dialog, funnels them into Windows Terminal / PowerShell. That shift matters: Terminal handles complex, multi-line scripts far more reliably than the Run dialog, letting attackers deliver a much heavier payload in one shot.
First detailed in a Microsoft Security Blog post on August 28, 2026, the campaign has since been corroborated by BleepingComputer, The Hacker News, and Dark Reading.
Attack Chain
| Stage | Action |
|---|---|
| 1. Lure | Compromised website shows a fake Cloudflare Turnstile CAPTCHA overlay |
| 2. Execution | Victim is told to copy/paste a "verification" command into Windows Terminal |
| 3. Delivery | Pasted PowerShell downloads a ZIP archive to C:\ProgramData and silently runs a batch file |
| 4. Sideloading | The batch file launches LockScreenContentServer.exe, a signed legitimate binary, which sideloads a malicious DLL |
| 5. Payload assembly | Steganographic PNG images are used to hide and reconstruct executables/DLL fragments from a C2 server |
| 6. Persistence | A custom Python-based reverse-tunnel implant tunnels arbitrary TCP traffic over an encrypted WebSocket back to attacker infrastructure |
Unlike earlier ClickFix campaigns that typically drop a single infostealer, TerminalFix combines DLL sideloading, steganographic payload extraction, Active Directory reconnaissance, and network-level tunnel access into one multi-stage intrusion.
Why Microsoft Calls It "Particularly Dangerous"
The reverse tunnel gives attackers direct, persistent access to the victim's internal network — not just the initially compromised host. Microsoft notes that in the hands-on-keyboard phase that typically follows, operators use this access to escalate privileges, disable security controls, exfiltrate data, and deploy ransomware across the organization. Microsoft says it discovered the campaign in the wild but has not yet observed that hands-on-keyboard follow-through — meaning the exposure window is still open for anyone who ran the initial command.
Mitigation Recommendations
- Restrict PowerShell and Run dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy.
- Consider blocking or auditing Win+R where it isn't required for daily work.
- Monitor for DLL sideloading — alert on
LockScreenContentServer.exeexecuting from any path other thanC:\Windows\SystemApps. - Train users to recognize fake CAPTCHA/ClickFix prompts asking them to "verify" by pasting a command.
- If compromise is suspected, investigate for lateral movement and rotate credentials — including domain admin credentials reachable from the infected host.
Sources
- Microsoft Security Blog — TerminalFix campaign deploys a reverse tunnel through multistage intrusion
- BleepingComputer — Microsoft warns of TerminalFix attacks deploying reverse tunnels
- The Hacker News — TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
- Dark Reading — 'TerminalFix' Campaign Uses PowerShell for Enterprise Attacks