Microsoft Warns of "TerminalFix" ClickFix Variant Deploying Reverse Tunnels via Windows Terminal

Microsoft has issued a warning about a new ClickFix-style social engineering campaign it has dubbed TerminalFix, according to a report from BleepingComputer. The technique uses fake Cloudflare CAPTCHA verification prompts injected into compromised websites to trick victims into copying and running malicious PowerShell commands — but instead of the classic Windows Run dialog used in earlier ClickFix waves, this variant directs victims to paste the commands into Windows Terminal, and the payload reportedly establishes reverse tunnels for attacker access.

Why It Matters

ClickFix-family attacks have proven effective because they rely on the victim performing the "malicious" action themselves, bypassing many technical controls that watch for automated exploitation or malicious attachments. By moving the lure to Windows Terminal, the technique may also sidestep detection and user-awareness training that has been tuned specifically around the Win+R "Run" dialog pattern. The reported use of reverse tunnels suggests the goal is establishing persistent, attacker-controlled access into the victim's environment — a foothold that can be leveraged for follow-on activity such as credential theft or lateral movement. Any organization where users browse the general web is potentially exposed, since the initial lure lives on compromised legitimate sites rather than requiring a targeted phishing email.

What Defenders Should Do Now

• Review and update ClickFix detection logic so it isn't scoped narrowly to the Run dialog — look for PowerShell process trees spawned from WindowsTerminal.exe / wt.exe, not just explorer.exe.
• Hunt for suspicious clipboard-to-terminal execution patterns, especially short-lived PowerShell sessions launched shortly after a browser process, which can indicate a paste-and-run lure.
• Monitor for outbound reverse-tunnel indicators: unexpected long-lived outbound connections from PowerShell or terminal-spawned processes, especially to unfamiliar external hosts or over ports/services not typical for the environment.
• Refresh user awareness training to cover the Windows Terminal variant explicitly, since prior ClickFix training may have focused only on the Run-dialog lure.
• Consider browser and endpoint controls that flag or block clipboard-driven command execution in terminal applications.

This is developing intelligence based on a single vendor advisory reported by BleepingComputer, and further technical detail (specific tunnel infrastructure, payload samples, or scope of compromised sites) had not yet been published at the time of writing. For the original report, see BleepingComputer's coverage.