Microsoft warns of TerminalFix campaign using Windows Terminal to plant backdoors

According to tech news outlet TechRadar, the campaign works by displaying a fake Cloudflare CAPTCHA on tainted websites. Visitors who encounter the overlay are instructed to copy and paste a PowerShell command into Windows Terminal or PowerShell, a technique similar to the known ClickFix attacks but redirected from the Windows Run dialog to more capable command-line environments.

Microsoft explained that while classic ClickFix campaigns rely on the Run dialog, TerminalFix directs victims to Windows Terminal or PowerShell, increasing the chance that complex multi-line scripts execute successfully. After the victim runs the command, two files are delivered: a legitimate binary and a malicious DLL. The binary sideloads the DLL, which then installs a hidden payload called client.py.

The client.py file is a custom Python implant that establishes an encrypted WebSocket connection to the attackers and grants them SOCKS5-style proxy access into the victim’s internal network. This allows the attackers to interact with internal machines, probe domain controllers, run commands, preserve access after reboots, and use the compromised machine as a pivot point for lateral movement.

Microsoft noted that the observed reconnaissance and reverse-tunnel capability could allow attackers to identify and reach additional systems from a compromised host. Although Microsoft did not observe actual lateral movement during its investigation, it warned that affected devices should be treated as potential network pivot points and investigated for credentials exposure and further intrusion.

Microsoft researchers named the campaign TerminalFix because of its resemblance to the classic ClickFix method. The report from TechRadar highlights that this type of intrusion is particularly dangerous because it provides direct access to an organization’s internal network through a reverse tunnel.