Windows TerminalFix ClickFix variant opens stealth tunnels

Microsoft Threat Intelligence has detailed a new Windows intrusion campaign dubbed TerminalFix, an evolution of the ClickFix social engineering technique that abuses fake Cloudflare CAPTCHA overlays to trick users into running attacker-controlled PowerShell commands in Windows Terminal or PowerShell.^{[1][2][11][13][15]}

Like classic ClickFix, TerminalFix starts when a victim lands on a compromised or malicious site that presents a convincingly branded Cloudflare-style “prove you are human” widget, but the challenge is rigged so normal checkbox or image-selection flows appear broken and the page instead instructs the user to copy a verification command and paste it into a system window.^{[1][4][9][12]} Earlier ClickFix lures have mostly pushed people toward the Windows Run dialog, whereas TerminalFix explicitly directs them to command-line environments, making it more reliable for executing obfuscated, multi-line scripts without user suspicion.^[1][11][13]

Once the victim pastes and runs the command, TerminalFix launches a multi-stage chain rather than a single infostealer payload: the initial PowerShell script downloads a ZIP archive to C:ProgramData, extracts it, and silently runs a batch file that uses DLL sideloading via the legitimate LockScreenContentServer.exe binary to load a malicious dui70.dll component.^[1][7][3] That sideloaded DLL then invokes additional PowerShell to retrieve PNG images from attacker infrastructure and parse their pixel data, using the first bytes to determine embedded file length before reconstructing an executable and DLL fragments that are written to disk and joined into the next-stage payload.^[1][3][11] The campaign establishes persistence through registry Run keys and scheduled tasks and performs domain-aware reconnaissance, ultimately deploying a custom reverse TCP tunnel implant that uses encrypted, web-like traffic over port 443 and multiplexes multiple internal connections through a single stealthy channel.^[1][7][13]

Unlike many ClickFix incidents that culminate in commodity information stealers, TerminalFix is primarily a network access operation designed to turn the compromised workstation into a proxy for further lateral movement, giving attackers a durable foothold inside corporate environments.^[1][3][15] Microsoft and other researchers stress that this is not a vulnerability or CVE-driven attack but a human-operated social engineering campaign, meaning there is no single patch that eliminates the risk and the initial compromise succeeds only when a user follows the on-screen instructions and executes the supplied command.^[1][3][12] Some related activity has also been observed blending ClickFix-style lures with blockchain-based “Etherhiding” techniques on BNB Smart Chain to conceal malicious infrastructure and loaders, underscoring how threat actors are mixing social engineering, evasive staging, and unconventional hosting to evade traditional defenses.^[2][5][13]

For defenders, TerminalFix offers several distinct telemetry clues: unexpected execution of LockScreenContentServer.exe outside its normal context, hidden or oddly named subfolders under C:ProgramData, repeated PowerShell use to download PNG files from unfamiliar domains, registry and scheduled task entries that re-launch the same binary, and persistent outbound connections over port 443 that do not match user or application behavior.^[1][3][7] Microsoft’s guidance recommends hunting for devices where users interacted with suspicious CAPTCHA verification prompts, correlating those events with any anomalous Terminal or PowerShell activity and investigating hosts that appear to be acting as network relays or tunnels, especially in environments where administrators do not typically use reverse-proxy tooling from endpoints.^[1][7][13]

At the user level, the most effective defense is simply refusing to run commands on behalf of a website: legitimate CAPTCHA systems may ask you to click boxes or select images, but they will not ask you to open Run, Windows Terminal, Command Prompt, or PowerShell and paste text.^[4][6][12] People should slow down when confronted with urgent-looking verification messages, avoid copy-pasting commands from pages, emails, or chats unless they fully understand the code, and independently verify any instructions with official documentation or support before proceeding.^[4][9][14] Organizations can further reduce exposure by hardening endpoint policies around scripting, deploying up-to-date anti-malware with web protection capable of blocking known ClickFix-style pages, and educating staff that attackers are actively iterating on these “prove you are human” lures to bypass traditional phishing filters and trick users into infecting themselves.^[1][3][6]

References

1. TerminalFix campaign deploys a reverse tunnel through …
2. Microsoft Warns of ClickFix and TerminalFix Attacks Using … – Binance
3. TerminalFix ClickFix Campaign: Defending Against Fake …
4. ClickFix and fake CAPTCHAs: defence guide 2026
5. ClickFix Phishing Pages Discovered in 24 npm Packages – OX Security
6. ClickFix finds a new way to infect Macs
7. Microsoft Security Research is investigating a TerminalFix …
9. ClickFix & ACR Stealer: Microsoft 365 token theft
11. TerminalFix: Fake Cloudflare CAPTCHAs & Terminal Backdoors
12. ClickFix Attack Exploits Fake Cloudflare Turnstile to Deliver Malware
13. ClickFix Malware Campaign Hides Payload Infrastructure in …
14. Windows CAPTCHA scam uses ClickFix to spread StealC …
15. Trending – The CyberSignal