TerminalFix: Microsoft Says ClickFix Now Points Victims at PowerShell, Not the Run Box

Microsoft Threat Intelligence has disclosed a ClickFix variant it calls TerminalFix, and the notable change is not a new exploit. It is where the trick sends you. Instead of the cramped, single-line Windows Run dialog that classic ClickFix abuses, TerminalFix walks victims into Windows Terminal or PowerShell, a full command environment where longer, multi-step commands are far more likely to run cleanly.

In an analysis published this week, Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan describe a campaign that begins with a fake Cloudflare CAPTCHA on a compromised website and ends with a custom reverse-tunnel backdoor that turns the infected PC into a foothold on the internal network. The Hacker News reported the disclosure on August 30, 2026. Microsoft says the campaign has hit organizations across multiple sectors, but it has not named any victim, industry, or threat actor.

What Changed: A Bigger Paste Box

TerminalFix keeps the ClickFix playbook and swaps only the destination. Users are told to open Windows Terminal or PowerShell and paste, not the Run box. Everything else is familiar: a web page claims you need to "verify" you are human, quietly copies an attacker-supplied command to your clipboard, and instructs you to paste it and press Enter.

The difference matters because the Run dialog is a poor place to run an attack. It is a one-line field that chokes on long or multi-line input. A terminal has no such ceiling. It happily accepts a whole script, which is exactly what an operator wants when the goal is a multi-stage install rather than a single download. It also blends into the kind of copy-paste that IT staff do all day, so the request looks less out of place.

Why the Target Matters

The reframing here is a defender's reframing: the payload is secondary, the interface is the point. As Microsoft's researchers put it, "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully."

In plain terms, moving the paste from Run to a real terminal widens the execution surface. A longer command can carry more logic before it needs to reach out to attacker infrastructure, and it runs inside a tool your users already trust. That is a social-engineering upgrade, not a technical one, which is why the fix is mostly about habits and process controls rather than a patch. TerminalFix is a reminder that the most damaging intrusions often start with plain social engineering rather than a zero-day, one entry in the broader catalog of common types of cyberattacks that lean on the user, not the software.

The Lure Is a Fake Cloudflare Check

The entry point is a compromised website that overlays a counterfeit Cloudflare Turnstile "verify you are human" prompt. Microsoft describes a convincing spoof, complete with the Cloudflare logo, a checkbox, and a spinner animation, that persuades visitors they must complete a verification step to see the page. Interacting with it stages the malicious command and points the user at their terminal.

Fake Cloudflare checks are becoming a signature move. We have covered the same lure hiding a macOS infostealer in the Based Apparel ClickFix incident, and the industrial-scale hijacking of legitimate sites to serve ClickFix and fake-update overlays in the DriveSurge access-broker campaign. The counterfeit CAPTCHA works because it borrows a security ritual users have been trained to click through without thinking.

What the Command Delivers

The endpoint of the chain is a custom reverse-tunnel backdoor that gives the attacker network-level proxy access through the victim's machine. Microsoft describes a multi-stage sequence that leans on DLL sideloading through a legitimate signed binary, payloads hidden inside PNG images using steganography, extensive Active Directory reconnaissance, and persistence through both registry Run keys and scheduled tasks before the tunnel goes up. We are deliberately not reproducing the command or the tunnel setup here; the value for defenders is in the shape of the attack, not its recipe.

A few things are worth flagging on confidence. Microsoft characterizes the implant as bespoke and custom, and did not tie it to a named, off-the-shelf tunneling tool or attribute the campaign to a specific group. It also says it did not observe the downstream hands-on-keyboard actions in the chain it analyzed, while warning that this kind of access could let an attacker escalate privileges, disable security controls, steal data, and deploy ransomware. Treat an affected host as a potential network pivot point and investigate for lateral movement and credential exposure.

There is a broader shift worth naming. Microsoft points out that earlier ClickFix variants usually dropped a single infostealer and stopped there. TerminalFix goes further, chaining that first paste into DLL sideloading, reconnaissance, persistence, and a network tunnel. That is the real escalation: the same throwaway social-engineering trick is now the front door to a full, hands-on intrusion rather than a smash-and-grab for browser passwords. The practical takeaway is to treat any ClickFix hit as a potential foothold, not just a stealer infection.

A Defender's Checklist

Because the meaningful change is the browser-to-terminal handoff, the strongest controls sit at that seam: user habits on one side, telemetry on the other.

What Defenders Should Do

Microsoft's own guidance lines up with the reframing above. The most useful steps, in priority order for most teams:

• Educate users on the paste-to-terminal tell. Train staff that no legitimate CAPTCHA or "verification" ever asks you to open Windows Terminal, PowerShell, or the Run dialog and paste a command. That single rule defeats the entire campaign at step one.
• Reduce standard-user reach to shells. Restrict PowerShell and Run dialog execution for standard users with AppLocker, Application Control for Windows, or Group Policy, and consider blocking or auditing the Win+R Run dialog where it is not needed for daily work.
• Turn on the Windows Terminal paste warning. Configure Windows Terminal to warn users when the text they are pasting spans multiple lines, which is precisely the shape of a ClickFix payload.
• Alert on browser-spawned shells. Flag any case where a browser process launches Windows Terminal, powershell.exe, or cmd.exe. Microsoft ships detections for this pattern, including "Possible ClickFix activity," plus advanced hunting queries for the sideloading and tunneling stages.
• Watch for tunneling egress. Monitor for anomalous outbound proxy or tunnel-like traffic; Microsoft's coverage includes a "Possibly malicious use of proxy or tunneling tool" detection for the reverse-tunnel stage.
• Log and constrain PowerShell. Enable PowerShell script block logging to surface obfuscated or encoded commands, and enforce Constrained Language Mode where you can.
• Assume network access on any hit. If a host ran the command, prioritize rotating every credential reachable from that machine, including domain admin accounts if the host was domain-joined.

My read: the interesting part of TerminalFix is not the malware, it is the interface choice. Pushing the paste target from Run to a real terminal quietly widens what an attacker can fit into one copy-paste, and it borrows the legitimacy of a tool admins use every day. So the defensive center of gravity should be the browser-to-shell handoff and the user habit of pasting on request, not any single hash or domain, which will rotate the moment this write-up circulates.

Primary Documents

• Microsoft Threat Intelligence, "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" (August 28, 2026), with detections, hunting queries, and indicators of compromise.
• The Hacker News, "TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor" (August 30, 2026).