TerminalFix: New ClickFix Drops Reverse-Tunnel Backdoor

The ClickFix playbook keeps getting refined. Microsoft this week detailed TerminalFix, a variant of the clipboard-injection social engineering technique that shifts the target from a browser dialog box to Windows Terminal or PowerShell, and swaps the usual stealer or miner payload for a reverse-tunnel backdoor.

That last detail is worth dwelling on. Stealers grab credentials and exit. A reverse-tunnel backdoor establishes persistent access that an operator can reuse, hand off, or hold in reserve. The operational profile is different: this is infrastructure, not a smash-and-grab.

How TerminalFix works

Classic ClickFix presents a fake browser error or CAPTCHA, instructs the victim to press Win+R and paste a command from the clipboard, and collects whatever the script delivers. TerminalFix, according to Microsoft’s disclosure, routes the same deception through fake Cloudflare CAPTCHA verification pages. The lure instructs users to open Windows Terminal or PowerShell directly and run the provided command, bypassing the Win+R run box entirely.

The mechanism is familiar. The delivery channel is slightly different, and the attacker tooling behind it is more patient.

Why the terminal shift matters

Browser run-box lures have a ceiling: they require the user to navigate a Windows UI flow that some users or endpoint controls will interrupt. PowerShell and Windows Terminal accept the same commands with fewer friction points for users who are already accustomed to running scripts. That is not a commentary on those tools; it is an observation about how the threat actor perceives the path of least resistance.

The reverse-tunnel component means that once a machine runs the command, outbound connections from a legitimate-looking process can maintain a channel that survives reboots and credential rotations, depending on the persistence mechanism involved. Microsoft did not publish those specifics, and reproducing them here would not serve a defensive purpose anyway. The point is that the payload class has changed.

The ClickFix family is not slowing down

TerminalFix joins a long list of ClickFix variants observed over the past year. Earlier campaigns deployed AmnesiaStealer via fake Cloudflare checks on macOS, pushed miners to gamers via Steam forum impersonation, and were adopted by Sandworm-linked operators targeting Ukrainian infrastructure. The technique works because it relocates the malicious action to the user rather than the exploit. There is no CVE to patch.

The payload diversity is the point. ClickFix is a delivery abstraction; whoever holds the lure infrastructure can swap in stealers, miners, loaders, or backdoors as the campaign objective changes.

Detection and response

Microsoft’s disclosure is a starting point. The actionable posture for defenders:

• User awareness. No legitimate CAPTCHA verification requires opening a terminal or running a system command. Full stop. Users who understand that have already defeated this attack.
• Script block logging. PowerShell and Windows Terminal commands run under user context, but PowerShell’s ScriptBlockLogging and Module Logging catch the invoked content before it executes. If you have Windows Defender for Endpoint or equivalent telemetry, this is where TerminalFix leaves its first footprint.
• Outbound tunnel detection. Reverse tunnels typically beacon to cloud infrastructure on standard ports. DNS query patterns, unusual persistent outbound connections from workstations, and endpoint isolation policies all help here. The APT28 HOOKEDGE campaign from last week used a structurally similar persistence model.
• Restrict Terminal where practical. Enterprises that have no reason for standard users to invoke Windows Terminal can remove or restrict it via AppLocker or WDAC policy. It is a narrow population, but it is a real control.

The pattern behind TerminalFix is familiar: take a working social engineering primitive, change one assumption about where the user interaction happens, change the payload for the campaign objective. The same mistake, framed differently this decade.

For the full technical details Microsoft has chosen to share publicly, see the original disclosure.