As reported by BleepingComputer, Microsoft has identified a new ClickFix variant called TerminalFix that significantly raises the stakes for this already-prolific attack pattern. While previous ClickFix campaigns primarily delivered infostealers, TerminalFix establishes a persistent reverse tunnel into the victim's internal network — transforming a routine browsing incident into a potential beachhead for ransomware deployment.

Threat Alert: As reported by BleepingComputer, Microsoft has identified a new ClickFix variant called TerminalFix that significantly raises the stakes for this already-prolific attack pattern.

Why This Evolution Matters

The shift from credential theft to network pivoting represents a meaningful tactical upgrade. Traditional ClickFix attacks were largely opportunistic — grab cookies and passwords, exfiltrate, and move on. TerminalFix instead mirrors the early stages of a targeted intrusion: reconnaissance of domain controllers, backup servers, and Active Directory, followed by establishing a SOCKS5-capable tunnel that multiplexes connections over an encrypted WebSocket to gitnow[.]dev:443.

This is the difference between a pickpocket and someone who picks the lock, enters your building, and maps every door. The latter enables follow-on operations that organizations typically associate with nation-state tradecraft rather than socially engineered malware.
The use of Windows Terminal as the execution vector is particularly clever — it bypasses browser-based security warnings while lending the operation an air of administrative legitimacy that standard browser pop-ups cannot achieve.

Technical Indicators of Concern

Why This Evolution Matters
DLL side-loading via a legitimate signed executable paired with a malicious DLL
Steganographic payload delivery using three PNG images to reconstruct executables and DLL fragments in memory
Dual persistence mechanisms — scheduled task and Registry Run key executing hourly
Encrypted WebSocket reverse tunnel with User-Agent rotation and connection multiplexing to evade network monitoring
Infrastructure abuse — routing C2 traffic through gitnow[.]dev on port 443 to blend with legitimate HTTPS traffic

Who Is Most Exposed

Organizations where users operate with local administrative privileges face the highest risk. The attack chain's reliance on PowerShell execution, scheduled task creation, and Registry modification requires elevated permissions to fully succeed. Environments without PowerShell logging or Script Block Logging will struggle to detect the intermediate stages before the tunnel activates.

Remote workers and unmanaged BYOD devices connecting to corporate VPNs represent an especially dangerous vector — a compromised personal device with an active reverse tunnel can reach internal resources through the VPN session, effectively bypassing perimeter controls.

Shield53 Recommendations

Immediate Actions

  • Block and monitor the C2 domain gitnow[.]dev at DNS, proxy, and firewall layers. Flag any historical connections in your SIEM.
  • Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) via Group Policy if not already deployed.
  • Deploy AMSI integration for PowerShell — the in-memory payload execution stage should be caught by AMSI-aware antivirus.
  • Restrict Windows Terminal and PowerShell access for non-administrative users via AppLocker or Windows Defender Application Control.
  • Hunt for persistence indicators — review scheduled tasks for hourly execution patterns and Registry Run keys pointing to unusual paths.

Strategic Defenses

  • Implement egress filtering — workstations should not establish outbound WebSocket connections to non-corporate domains on port 443 without inspection.
  • Deploy DNS sinkholing for known malicious infrastructure and monitor for newly registered domains that mimic developer tooling platforms.
  • Conduct user awareness training specifically addressing CAPTCHA-based social engineering — legitimate verification processes never require pasting PowerShell commands into a terminal.
  • Segment internal networks so that compromised workstations cannot directly reach domain controllers, backup servers, and database hosts without additional authentication barriers.

The TerminalFix campaign underscores a broader trend: threat actors are investing more engineering effort into post-compromise tooling delivered through low-sophistication initial access. Defenders must stop treating ClickFix-style attacks as mere nuisance infections and recognize them as potential entry points for full-scale network compromise.