Microsoft has identified a new attack campaign dubbed "TerminalFix" that tricks victims into running malicious PowerShell commands via a fake Cloudflare CAPTCHA prompt, ultimately installing a custom reverse tunnel that gives attackers persistent, network-level access to compromised machines. It is a more sophisticated variant of the widespread "ClickFix" social engineering technique, directing users to Windows Terminal or PowerShell rather than the Run dialog, which increases the chance that multi-line malicious scripts get executed unknowingly. Microsoft declined to say how many organisations have been affected or who is behind the campaign.

The attack chain begins with a spoofed Cloudflare verification checkbox that copies a malicious command to the clipboard for the victim to paste and run, downloading a ZIP file that launches a signed Windows executable used for DLL sideloading. A malicious DLL then fetches further payloads hidden inside PNG images using steganography, split across three files to evade detection, before deleting the source images to cover its tracks. The malware secures persistence via registry keys and hourly scheduled tasks, conducts Active Directory and domain reconnaissance across multiple languages, and probes named servers such as domain controllers, databases and mail systems to identify further targets, while a PowerShell loop awaits further commands from the attacker.