TerminalFix ClickFix Attack Hides in PowerShell Terminal

What Happened: Microsoft Flags a New ClickFix Variant Called TerminalFix

Microsoft Threat Intelligence has disclosed a new social-engineering campaign, tracked internally as TerminalFix, that steers victims toward Windows Terminal or PowerShell instead of the Windows Run dialog used in earlier ClickFix attacks. ClickFix is a social-engineering technique in which a fake error message, CAPTCHA, or verification prompt instructs a website visitor to copy and paste a command into a Windows dialog box, causing the victim to unknowingly execute malicious code on their own device. According to Microsoft, TerminalFix pages display a spoofed Cloudflare Turnstile prompt, Cloudflare Turnstile is a legitimate, widely deployed bot-verification widget used by many websites to filter automated traffic, on compromised or attacker-controlled sites, then instruct the visitor to "verify" by pasting a command into Terminal or PowerShell rather than Run.

Microsoft's researchers say the shift to a full terminal environment is deliberate. PowerShell and Windows Terminal can process longer, more complex, multi-stage commands than the single-line Run dialog, giving attackers more room to chain download, decode, and execution steps into a single pasted block. Microsoft reports that the observed payload chain includes DLL sideloading, a technique in which malware places a malicious library file next to a legitimate, digitally signed application so the trusted program loads and runs attacker code without the user noticing anything unusual. The chain reportedly culminates in a reverse tunnel, a network connection initiated from inside the victim's machine out to attacker infrastructure, which gives the operator persistent remote access even through restrictive firewalls that block unsolicited inbound connections.

Why the Terminal Switch Matters

Earlier ClickFix campaigns relied on the Windows Run dialog, a box most users associate with quick, harmless actions like opening a program. Security awareness training over the past two years has increasingly warned employees to be suspicious of "paste this into Run" prompts, which may be reducing the technique's success rate. By redirecting victims to Windows Terminal or PowerShell instead, TerminalFix targets a tool that many non-technical users perceive as more legitimate or IT-related, precisely the kind of unfamiliar, official-looking interface that can make a scripted request feel more credible rather than less. Microsoft notes this also expands the technical ceiling of the attack: a terminal session can silently install persistence, disable logging, or reach out to remote infrastructure in ways a single Run command cannot easily replicate.

Because the victim manually types or pastes the command and presses enter themselves, TerminalFix bypasses many of the controls organizations rely on to stop malware delivery, including email attachment scanning, browser download blocking, and macro restrictions. The malicious action originates from a legitimate, signed system tool, PowerShell or Windows Terminal, being run by an authenticated user, which can make it harder for some security tools to distinguish from routine administrative activity until the reverse tunnel or DLL sideloading behavior appears.

What This Means For Your Business

Healthcare practices, tax and accounting firms, and small businesses are attractive TerminalFix targets precisely because front-desk and back-office staff often browse the open web on the same machines that hold patient records, tax filings, or financial systems, and because many of these environments grant local administrative rights or leave PowerShell unrestricted for convenience. A successful TerminalFix compromise that establishes a reverse tunnel gives an attacker a foothold that can persist well beyond the initial visit, potentially enabling lateral movement toward practice management software, electronic health record systems, or tax preparation platforms. If patient data or taxpayer information is later accessed or exfiltrated through that foothold, practices could face HIPAA breach-notification obligations or IRS Safeguards Rule review, separate from any direct financial loss tied to fraud or ransomware that follows.

This campaign also underscores a training gap that many organizations have not yet closed. Security awareness programs have spent years teaching staff to distrust suspicious email links and attachments, but far fewer have specifically covered ClickFix-style prompts that ask users to run a command themselves, whether via Run, PowerShell, or Terminal. Because the action feels self-directed rather than externally imposed, employees may not recognize it as the same category of threat as clicking a phishing link.

Practical Steps to Reduce Risk

Bellator Cyber Guard recommends the following near-term actions for small-business and clinical environments:

• Update security awareness training now to explicitly cover ClickFix and TerminalFix: no legitimate site verification requires opening Terminal, PowerShell, or Run and pasting a command.
• Restrict PowerShell where feasible using Constrained Language Mode, execution policy controls, or application allow-listing tools such as Windows Defender Application Control or AppLocker for staff who do not need scripting access for their job.
• Remove unnecessary local administrator rights from front-desk, clinical, and clerical workstations, since many ClickFix payload chains rely on elevated privileges to install persistence.
• Ensure endpoint detection and response (EDR) tooling is active and current on every device, and confirm it alerts on unusual outbound tunnel connections and DLL sideloading behavior rather than only known malware signatures.
• If a staff member reports having pasted a command into Terminal, PowerShell, or Run after a suspicious CAPTCHA or verification prompt, isolate the device from the network immediately, reset any credentials that were active in that session, and have IT or a managed security provider check for persistence mechanisms and unauthorized outbound connections before returning the machine to service.

TerminalFix is a reminder that attackers continue to adapt social-engineering lures faster than many organizations update their training. Treating any unsolicited request to run a command, regardless of which Windows tool it names, as a red flag is the single most effective defense available to non-technical staff today.