Microsoft has published details about a Windows malware campaign it calls TerminalFix.
The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard.
Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command.
After gaining a foothold, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites, but the images also contain concealed payload data. A PowerShell script reads the images’ pixel data: The first eight bytes specify the embedded file’s length, while the remaining data is reconstructed into an executable and two DLL fragments, which are joined on the victim’s disk.
The use of steganography is notable, but does not set TerminalFix apart from other ClickFix campaigns that have used the same method.
What does make TerminalFix different is its payload. One way or another, ClickFix victims usually end up with information-stealing malware of some sort.
TerminalFix instead chains together several mature evasion techniques, including DLL sideloading, steganographic delivery, folder hiding, realistic browser User-Agent rotation, and encrypted WebSocket traffic, rather than relying on one obfuscated PowerShell downloader. Its end goal is also different.
The campaign delivers a payload chain that performs domain-aware reconnaissance before installing a custom, multiplexed reverse TCP tunnel.
This hidden connection can give attackers access to the victim’s network. The infected computer first calls out to the attackers using encrypted web-like traffic over port 443, allowing the “reverse” connection to pass more easily through a company firewall.
In this way, the compromised system creates a secret remote-access doorway from inside the network. “Multiplexed” means the attackers can send several separate connections, for example to a file server, database, or another workstation, through that single encrypted tunnel at the same time. This allows them to use the victim’s computer as a stepping stone into the rest of the network.
How to stay safe
First, remember that a real CAPTCHA may ask you to click boxes or select images, but it will not ask you to open Run, Terminal, Command Prompt, or PowerShell and paste a command.
- Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Attackers rely on urgency to discourage careful thought, so be cautious of pages urging immediate action. Sophisticated ClickFix pages may add countdowns, user counters, or other pressure tactics to make you act quickly.
- Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand exactly what the command will do.
- Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
- Limit the use of copy and paste for commands. Manually typing commands instead of copy-pasting can reduce the risk of unknowingly running malicious payloads hidden in copied text.
- Secure your devices. Use an up-to-date, real-time anti-malware solution with a web protection component.
- Learn to recognize evolving attack techniques. Knowing that attackers continually change their methods can help you recognize suspicious instructions. Keep reading our blog!
Pro tip: Did you know that the free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard?
Some browsers also restrict or warn about certain uses of the clipboard. Since macOS Tahoe 26.4, Terminal can warn users when they paste text copied from a browser or messaging app. This protection operates at the app and operating-system level rather than inside the browser.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
