Microsoft has uncovered a new malware campaign called TerminalFix that deceives users into executing malicious commands directly in Windows Terminal or PowerShell. Security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan disclosed the threat this week, noting that the campaign targets organizations across multiple sectors. Unlike earlier ClickFix attacks that directed victims to the Windows Run dialog, this variant pushes users toward Windows Terminal or PowerShell, which increases the chances that complicated, multi-line scripts will run without errors.
The attack starts when compromised websites display fake Cloudflare CAPTCHA screens that trick visitors into copying and running a harmful PowerShell command. That command downloads a ZIP file holding a legitimate binary called LockScreenContentServer.exe and a malicious DLL named dui70.dll, triggering a DLL sideloading attack. The rogue DLL then pulls additional payloads concealed inside PNG images from external domains—bestsocialmedianewspapper[.]com or offlineupdater[.]com—and sets up persistence through both Registry Run keys and scheduled tasks. The malware also conducts domain reconnaissance by collecting system metadata, performing domain trust discovery, enumerating domain admins, searching Active Directory for users and computers, and pinging named servers to map the internal network. Finally, it deploys a Python-based reverse-tunnel backdoor called client.py that funnels arbitrary TCP traffic back to attacker infrastructure at gitnow[.]dev:443 via an encrypted WebSocket channel, letting the command-and-control server reach any host visible from the victim's network.
According to Microsoft, "This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel." The company warns that the observed reconnaissance and reverse-tunnel capability could let an attacker identify and reach additional systems from a single compromised host. The tech giant also notes that such access can be exploited to escalate privileges, disarm security controls, steal sensitive data, and deploy ransomware, making TerminalFix a serious threat to enterprise environments. The attack further installs a persistent PowerShell file-watch loop that monitors a text file for new commands, runs them using Invoke-Expression, and writes the results to an output file.
To counter the threat, Microsoft recommends that organizations restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy. IT teams should also consider blocking or auditing the Windows Run dialog if it isn't required, monitor for DLL sideloading indicators, and enable PowerShell script block logging to detect obfuscated or encoded commands. Employee training to recognize ClickFix attacks is another key defense, since the entire chain begins with a user copying and pasting a command from a fake CAPTCHA screen. The guidance underscores that stopping the initial social-engineering step can prevent the entire multi-stage intrusion from taking hold. Organizations that depend on open terminal access for legitimate workflows face a difficult choice between operational flexibility and the risk of sophisticated command injection, while defenders must now treat even routine CAPTCHA prompts as potential entry points for network-wide compromise.