TerminalFix ClickFix Attack: What It Is and How to Defend Your Organisation

Businesses that rely on Windows workstations are facing a new phishing‑style campaign that hijacks PowerShell and Windows Terminal to run malicious code. Microsoft has disclosed the details of this campaign, naming the variant TerminalFix. The attack chain is sophisticated, but the practical steps to protect your environment are clear.

How the attack reaches users

The campaign starts with compromised public‑facing websites. Visitors to these sites are presented with a fake Cloudflare CAPTCHA prompt. The prompt asks the user to copy a PowerShell command and paste it into a terminal window. This social‑engineering trick is the first point of compromise.

The malicious payload chain

The copied command downloads a ZIP archive. Inside the archive are two files:

• LockScreenContentServer.exe, a legitimate Windows binary that the attacker re‑uses.
• dui70.dll, a rogue Dynamic‑Link Library (DLL) that is loaded by the legitimate binary, a technique known as DLL sideloading.

The sideloaded DLL reaches out to external domains such as bestsocialmedianewspapper.com or offlineupdater.com. It extracts further payloads that are hidden inside PNG image files hosted on those domains.

Persistence and network reach

Once the second‑stage payload is in place, the malware establishes persistence in two ways:

• Adding entries to the Registry Run keys so the payload starts on every login.
• Creating scheduled tasks that run with system privileges.

Photo by AMORIE SAM on Pexels

The DLL also performs extensive Active Directory (AD) reconnaissance, mapping domain trusts, enumerating domain administrators, and searching for user and computer objects. This information helps the attacker understand the network layout.

A Python‑based reverse‑tunnel implant, named client.py, is dropped onto the host. The implant creates an encrypted WebSocket connection to gitnow.dev:443 and tunnels arbitrary TCP traffic. Through this tunnel the command‑and‑control (C2) server can reach any host inside the victim network.

In addition, a persistent PowerShell file‑watch loop monitors a specific text file. When new commands appear, the loop executes them with Invoke‑Expression and writes the results to an output file, giving the attacker a low‑profile way to run arbitrary commands.

Photo by Tima Miroshnichenko on Pexels

What the attacker can do

Microsoft warns that the capabilities of TerminalFix can be abused to:

• Elevate privileges to domain‑admin level.
• Disable security controls such as endpoint protection or logging.
• Exfiltrate sensitive data from file shares or databases.
• Deploy ransomware payloads that encrypt critical files.

Practical steps to protect your organisation

The mitigation advice from Microsoft can be grouped into three areas: prevent execution, detect abuse, and educate users.

Restrict PowerShell and Run dialog execution

• Use AppLocker, Application Control for Windows, or Group Policy to allow only authorised users to launch PowerShell or the Windows Run dialog (Win+R).
• If the Run dialog is not required for standard users, block it outright or enable auditing so any attempt is logged.

Detect and block sideloading behaviour

• Monitor for the creation of new DLL files in the same directory as known Windows binaries such as LockScreenContentServer.exe.
• Enable PowerShell script block logging (see the Microsoft Learn guide) to capture obfuscated or encoded commands. The logging can be turned on via Group Policy under Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging (source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6).

Strengthen user awareness

• Conduct regular training that highlights the look‑alike Cloudflare CAPTCHA trick and the broader ClickFix technique.
• Encourage users to verify any request to copy‑paste PowerShell commands, especially when it originates from a web page.

By applying these controls, organisations can significantly reduce the risk of a TerminalFix infection and limit the damage should an incident occur.

Terms used in this article

• ClickFix, a social‑engineering attack that tricks users into running a command that fixes a fabricated problem.
• PowerShell, a Windows command‑line shell and scripting language used for automation.
• DLL sideloading, a method where a legitimate executable loads a malicious DLL placed in the same folder.
• Active Directory (AD), Microsoft’s directory service that stores information about users, computers and security policies.
• Registry Run keys, registry entries that cause programs to start automatically when a user logs on.
• Scheduled task, a Windows feature that runs a program at a set time or event.
• Reverse tunnel, a technique that creates an outbound connection from a compromised host to a remote server, allowing the server to communicate back into the internal network.
• Script block logging, a PowerShell feature that records the full content of scripts before they are executed.

Stratum is a Microsoft partner, and this advisory reflects our independent analysis of the disclosed threat.