As reported by The Hacker News, Microsoft has detailed a new ClickFix variant dubbed TerminalFix that uses fake Cloudflare CAPTCHA pages to trick users into executing malicious PowerShell commands directly within Windows Terminal. This represents a meaningful evolution in social engineering tradecraft—and one that should reset assumptions about how far browser-based deception can go.

Threat Alert: The original ClickFix technique was already effective because it exploited user familiarity with CAPTCHA workflows.

Why TerminalFix Matters More Than Standard ClickFix

The original ClickFix technique was already effective because it exploited user familiarity with CAPTCHA workflows. But it had a structural limitation: pasting into the Windows Run dialog constrained payload complexity. By redirecting victims to Windows Terminal or PowerShell instead, TerminalFix removes that constraint entirely. Multi-line scripts, variable assignments, error handling, and staged downloads all execute cleanly—something the Run dialog's single-line input made difficult.

This is social engineering designed by people who understand Windows internals. The choice of Terminal over Run is not accidental—it is an engineering decision that expands the attack surface of human deception.

The campaign also demonstrates a mature kill chain that goes well beyond initial execution:

Why TerminalFix Matters More Than Standard ClickFix
DLL sideloading using a legitimate Microsoft binary (LockScreenContentServer.exe) paired with a rogue dui70.dll—a technique that evades application control and blends into normal process trees
Steganographic payload delivery via PNG images hosted on attacker domains, complicating network-based detection since image traffic rarely triggers inspection
Active Directory reconnaissance including trust discovery, domain admin enumeration, and internal network topology mapping
A Python-based reverse-tunnel implant (client.py) that establishes an encrypted WebSocket channel to gitnow[.]dev:443, effectively turning the victim into a proxy into the internal network
A file-watch C2 loop that monitors a text file for commands, executes them via Invoke-Expression, and writes results to an output file—a clever technique that avoids traditional network C2 patterns

Who Is at Risk

This campaign targets organizations across multiple sectors, not a specific industry. The delivery mechanism—compromised legitimate websites serving fake CAPTCHAs—means any user browsing the web on a domain-joined Windows machine is a potential entry point. Organizations with the following characteristics face elevated risk:

  • Environments where Windows Terminal is available and users have local execution rights
  • Flat network architectures where a single compromised host can reach multiple internal segments
  • Permissive egress policies that allow outbound WebSocket traffic on port 443 to arbitrary domains
  • Limited steganography inspection capabilities at the network edge

The Reverse-Tunnel Problem

The most concerning capability in this campaign is the reverse-tunnel implant. Once established, the attacker gains network-level access to everything visible from the victim host—file servers, databases, management interfaces, and potentially domain controllers. This effectively bypasses perimeter firewalls and VPN requirements. Traditional endpoint detection may flag the initial PowerShell execution, but if that window is missed, the tunnel operates as legitimate-looking encrypted traffic to a .dev domain on 443.

The file-watch C2 loop adds another layer of detection difficulty. By using local file I/O as a command channel rather than persistent network connections, the attacker creates a pattern that many EDR solutions are not configured to alert on.

Shield53 Recommendations

Immediate Actions

  • Block known indicators: Add bestsocialmedianewspaper[.]com, offlineupdater[.]com, and gitnow[.]dev to DNS blocklists and proxy deny lists. Note that attackers rotate infrastructure rapidly—treat these as starting points, not complete coverage
  • Hunt for sideloading artifacts: Search for instances of LockScreenContentServer.exe executing from non-standard locations, and monitor for dui70.dll loaded by processes where it should not appear
  • Detect the file-watch pattern: Create detection rules for PowerShell loops that read from and write to local text files in rapid succession, particularly those using Invoke-Expression
  • Audit outbound WebSocket traffic: Investigate sustained WebSocket connections to unfamiliar domains on port 443, especially from workstations

Strategic Defenses

  • Restrict Windows Terminal and PowerShell execution for non-technical users via AppLocker or Windows Defender Application Control. Users who do not need these tools should not have access
  • Deploy ASR rules: Enable Attack Surface Reduction rules in Microsoft Defender, particularly those blocking process creation from Office applications and obfuscated script execution
  • Implement DNS filtering: Use protective DNS services that categorize and block newly registered domains and known malware infrastructure
  • Segment networks: Ensure that compromised workstations cannot freely reach domain controllers, file servers, and management interfaces. Zero Trust network access principles apply here
  • User awareness training: Specifically train users that no legitimate CAPTCHA or verification process requires opening PowerShell or Terminal and pasting commands. This is the single highest-impact control for ClickFix variants

TerminalFix is not a novel technique—it is a refinement of a proven approach. The ClickFix family will continue evolving as long as users remain willing to paste commands into terminals. Technical controls matter, but the decisive battle is in user expectations. When every employee understands that no verification process requires them to run PowerShell, campaigns like this lose their primary delivery vector.