Microsoft Warns of New “TerminalFix” ClickFix Attack

Microsoft has uncovered a new ClickFix attack called TerminalFix, which tricks users into copying and running malicious commands in Windows Terminal or PowerShell.

The attacks use fake Cloudflare CAPTCHA pages on compromised websites. Victims are instructed to paste and execute a PowerShell command, which starts a multi-stage infection.

The command downloads a ZIP file containing a legitimate Windows executable and a malicious DLL. Through DLL sideloading, attackers then load additional malware hidden inside PNG images.

The malware can:

  • Collect system information
  • Discover Active Directory users, computers, and domain administrators
  • Map the internal network
  • Create persistence using Registry Run keys and scheduled tasks
  • Execute PowerShell commands
  • Establish a reverse tunnel to attacker-controlled infrastructure

The reverse tunnel is particularly dangerous because it can give attackers access to other systems reachable from the compromised machine.

Microsoft recommends restricting PowerShell execution for standard users, monitoring for DLL sideloading, enabling PowerShell Script Block Logging, and training employees to recognize fake CAPTCHA-based ClickFix attacks.