Sophisticated “TerminalFix” Campaign Tricks Users into Granting Attackers Access to Enterprise Networks
A new campaign has emerged that tricks users into opening PowerShell and executing a malicious command, allowing attackers to establish a foothold inside enterprise networks. Dubbed “TerminalFix,” this sophisticated attack chain is designed to evade detection and grant threat actors direct access to internal networks.
The campaign works by presenting victims with a fake Cloudflare CAPTCHA overlay, which requires them to open Windows Terminal or PowerShell and paste a malicious command into the console. This command downloads and launches a zip archive containing a malicious DLL for sideloading, which kicks off the rest of the attacker’s complex attack chain. The attackers then use this access to conduct domain reconnaissance, deploy a reverse-tunnel C2 implant, and eventually exfiltrate sensitive data.
What sets TerminalFix apart from other campaigns is its ability to bypass traditional security controls. By using PowerShell instead of Windows Run to launch a downloader, the attackers increase the likelihood that longer, more complex scripts execute successfully. This makes it easier for them to establish dual persistence through Registry Run keys and scheduled tasks, allowing them to maintain access to the network even if the initial payload is detected.
The campaign has been observed targeting organizations across multiple industries, with Microsoft researchers warning that it’s particularly dangerous due to its ability to grant attackers direct access to internal networks. Once inside, the attackers can leverage this access to escalate privileges, disable security controls, and deploy ransomware across the organization.
While Microsoft has dubbed TerminalFix a variant of ClickFix, some experts have questioned the naming convention. Proofpoint senior threat researcher Tommy Madjar argues that the use of terminal windows is not unique to this campaign and could be used in other types of attacks as well.
The TerminalFix campaign serves as a reminder that attackers are constantly evolving their tactics to evade detection. As such, it’s essential for organizations to remain vigilant and take proactive measures to prevent these types of attacks. This includes educating users on the dangers of clicking on suspicious links or executing unknown commands, as well as implementing robust security controls to detect and prevent lateral movement.
In light of this campaign, we urge readers to exercise caution when interacting with online services that request access to PowerShell or other system consoles. Remember that legitimate organizations will never ask you to execute a command to “fix” a problem or complete a CAPTCHA in this manner. If you’re unsure about the authenticity of an email or link, it’s always best to err on the side of caution and report it to your IT department. By staying informed and taking proactive steps to secure your network, you can reduce the risk of falling victim to the TerminalFix campaign.
Source: Dark Reading — 2026-08-31