TerminalFix: New ClickFix Variant Lures Victims into Windows Terminal and PowerShell

What Happened

Microsoft has disclosed a new ClickFix-style social engineering campaign dubbed TerminalFix. Unlike traditional ClickFix attacks that direct victims to the Windows Run dialog, TerminalFix instead directs users to open Windows Terminal or PowerShell and paste a malicious command there. According to Microsoft's reporting, the campaign uses fake Cloudflare CAPTCHA pages as the delivery mechanism to convince users the action is a legitimate human-verification step.

The reported shift to Terminal/PowerShell as the target surface is notable because, per Microsoft, it increases the likelihood that more complex commands will execute successfully compared to the more constrained Run dialog.

Why It Matters for Defenders

ClickFix-style attacks rely entirely on social engineering rather than exploiting a vulnerability, which makes them effective against organizations with strong patch management but weaker user-awareness controls. By moving the lure to Windows Terminal and PowerShell, attackers can potentially stage more capable payloads or multi-stage command chains than what fits cleanly into a Run dialog invocation. Any organization where end users have the ability to open PowerShell or Windows Terminal and paste commands is potentially exposed — which in practice is most Windows environments.

The use of spoofed Cloudflare CAPTCHA pages as the social-engineering hook also means this technique can be embedded in otherwise unremarkable web traffic, making it harder for users to distinguish from legitimate bot-verification prompts they encounter daily.

What Defenders Should Watch For

• Hunt for PowerShell or Windows Terminal process launches with a parent process of a browser (e.g., explorer.exe spawning WindowsTerminal.exe or powershell.exe shortly after clipboard activity from a browser session).
• Monitor clipboard-to-terminal paste patterns where feasible, particularly commands pasted into PowerShell or Windows Terminal within seconds of visiting an external site.
• Review web proxy/DNS logs for fake or spoofed Cloudflare CAPTCHA/verification pages, especially ones hosted on non-Cloudflare infrastructure.
• Consider user-awareness training that specifically calls out ClickFix-style prompts, since this is fundamentally a social engineering technique rather than a software exploit.
• Evaluate whether PowerShell Constrained Language Mode, AppLocker, or similar controls are appropriate for user populations that don't need unrestricted terminal access.

Developing Intel

This is a net-new campaign disclosure and specific indicators, payload details, and full technical analysis were not included in the source summary available to us. Defenders should treat the above as high-level hunting guidance and consult Microsoft's original disclosure for further technical detail as it becomes available. Source: The Hacker News.