GoKawiilMicrosoft flags TerminalFix, a ClickFix variant using PowerShell for reverse network tunnels
Microsoft has identified a new ClickFix-style attack called TerminalFix that uses fake Cloudflare CAPTCHA pages on compromised websites to trick users into pasting and running malicious PowerShell commands in Windows Terminal. Rather than deploying simple infostealers, the campaign runs a multi-stage chain that hides payloads inside PNG images via steganography, establishes persistence through scheduled tasks and registry keys, and ultimately installs a custom Python-based reverse tunnel into the victim's internal network.
GoKawiil's interpretation of the reporting above, not reported fact.
By routing victims through Windows Terminal instead of basic dialog boxes, attackers can execute longer, more sophisticated scripts than typical ClickFix scams allow, making detection harder. The reverse tunnel gives intruders a persistent foothold for reconnaissance, credential theft, lateral movement, or ransomware deployment even though Microsoft hasn't yet observed hands-on exploitation.
- TerminalFix tricks users into running PowerShell commands via fake CAPTCHA verification.
- Attackers hide payloads inside PNG image pixel data using steganography.
- The final stage installs a reverse tunnel enabling deep access to internal networks.
YubiKey 5 NFC Security Key — Attacks like TerminalFix aim at credential theft and lateral movement, so hardware-backed sign-in is one of the strongest defenses you can add. The YubiKey 5 NFC plugs into USB-A or taps NFC-enabled phones and works with Microsoft accounts, Google, password managers and more for phishing-resistant login.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-31
Published there as: “Microsoft warns of TerminalFix attacks deploying reverse tunnels”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.