Sophisticated Attack Campaign Targets Enterprises with PowerShell Trickery
A new wave of targeted attacks is sweeping across enterprise networks, using a clever trick to lure victims into executing malicious commands within Windows PowerShell. Dubbed “TerminalFix” by Microsoft researchers, this campaign leverages the power of PowerShell to launch a complex attack chain that can evade detection and grant attackers unfettered access to sensitive data.
The TerminalFix campaign begins innocently enough, with users presented with a fake CAPTCHA prompt overlaid on a legitimate website. To complete the verification process, victims are told to open Windows PowerShell and paste a command into the console. Unbeknownst to them, this command has been silently copied to their clipboard by the attacker’s script.
While PowerShell is often confused with Windows Terminal, Microsoft notes that modern Windows installations automatically integrate Terminal into PowerShell by default. This subtle distinction allows attackers to direct victims into executing longer, more complex scripts that might otherwise be blocked or detected by security controls.
Once the initial command is executed, a malicious DLL is downloaded and launched via sideloading. This sets off a chain reaction of events that includes downloading payloads hidden within PNG images, establishing dual persistence through Registry Run keys and scheduled tasks, conducting domain reconnaissance, and deploying a Python-based reverse-tunnel C2 implant.
The most insidious aspect of the TerminalFix campaign lies in its use of reverse tunnels to establish direct access to victim organizations’ internal networks. This allows attackers to escalate privileges, disable security controls, exfiltrate sensitive data, and deploy ransomware across the organization with ease.
Microsoft researchers have characterized the campaign as “particularly dangerous” due to its combination of stealth techniques and persistent network access. However, some experts have questioned the TerminalFix naming, suggesting that it may not be a distinct variant of ClickFix-style attacks, but rather an extension of existing tactics.
Regardless of its classification, the TerminalFix campaign serves as a stark reminder of the ongoing threat posed by sophisticated attackers to enterprise environments. To mitigate this risk, organizations should take steps to educate their users about the dangers of PowerShell-based attacks and ensure that their security controls are capable of detecting and blocking complex scripts and payloads.
Ultimately, the success of the TerminalFix campaign highlights the importance of vigilance in the face of evolving threats. By staying informed and taking proactive measures to protect against sophisticated attacks, organizations can reduce their risk of falling victim to this type of campaign.
Source: Dark Reading — 2026-08-31