SURIQ
For two years the ClickFix playbook trained people to do one thing: open the Windows Run box, paste a command they did not write, and press Enter. Defenders answered the way you would expect. Awareness training called out the Run dialog by name, endpoint rules started watching for a browser handing a command to explorer.exe, and some shops disabled Win+R outright. TerminalFix is the counter-move. It keeps the fake human-verification trick and simply relocates the paste into Windows Terminal or PowerShell, where the old dialog-specific defenses do not look and where multi-line scripts actually run. The relocation is the story, not the campaign.
Microsoft researchers documented TerminalFix in late August 2026 as a ClickFix variant, and were candid that they had not watched hands-on activity end to end. That caveat matters: treat the chain below as a well-sourced reconstruction, not a confirmed intrusion timeline. What they described is a clean, patient operation built to look boring at every step.
What Microsoft documented
The lure is a fake Cloudflare CAPTCHA served from compromised websites. Instead of a checkbox, the page tells the visitor to complete verification by pasting a command that is already sitting in their clipboard. Because the instructions now point at Windows Terminal or PowerShell rather than the Run box, a long, obfuscated, multi-line script pastes and executes cleanly, which the single-line Run field never allowed.
The command pulls a ZIP that pairs a legitimate signed executable, LockScreenContentServer.exe, with a rogue dui70.dll. That is the same DLL sideloading with a signed binary we have written about before: the trusted process loads the attacker's library and decodes an obfuscated payload straight into memory. Later stages hide inside PNG images. The malware downloads image files from attacker domains, then reassembles executable fragments out of the pixel data on disk. Persistence is unremarkable on purpose: scheduled tasks, Registry Run keys set to fire hourly, and a PowerShell loop that watches a text file for new commands.
Then it goes hunting. Microsoft describes reconnaissance that probes for domain controllers, databases, and backup servers, enumerates Active Directory, and looks specifically for domain administrator accounts reachable from the infected host. The payload that ties it together is a custom Python reverse tunnel, client.py, that dials out to gitnow[.]dev on port 443 over an encrypted WebSocket. It offers SOCKS5-style TCP proxying, multiplexes many connections over that one channel, rotates realistic browser User-Agent strings, keeps the link alive, and accepts a remote shutdown command.
Every stage is built to look boring
Read that list again as a defender and the design intent is obvious. A signed Microsoft-style binary loading a DLL is normal. A process pulling down PNG files is normal. An outbound 443 connection to a domain that reads like a developer tool, gitnow, blends into a workday full of GitHub, npm, and package registries. None of these indicators is damning on its own, and the specific file names, hashes, and domains will rotate the day after they are published. A defense built on blocking today's indicators fails by construction, because the operator built the chain to survive exactly that.
This is the practitioner point the source reports do not spell out. TerminalFix is not really a new piece of malware to add to a blocklist. It is the ClickFix family adapting around the defenses that worked, and the durable lesson is the pattern, not the payload. We made the same argument when we mapped the shared ClickFix delivery pattern across campaigns: the delivery evolves faster than any single indicator.
The signal is the sequence, not the indicator
If no single stage is suspicious, the tell is the order they happen in. That is a correlation problem, which is what a Wazuh-based detection setup exists to solve and what an antivirus signature cannot. The chain worth alerting on looks like this:
-
A terminal born from a browser. WindowsTerminal.exe or powershell.exe spawned as a child of a browser process, within seconds of a page load, is the paste moment. On its own it is your highest-value early signal.
-
A LOLBin from the wrong place. A signed binary such as LockScreenContentServer.exe running from a user-writable path, or loading a DLL from a directory it never normally uses, is the sideload.
-
Persistence created minutes after. A new scheduled task or Run key registered shortly after a terminal session, especially one pointing at a script that watches a file, ties the intrusion together.
-
A long-lived encrypted tunnel. A sustained outbound 443 WebSocket to a young or low-reputation domain, with rotating User-Agents and keepalives, is the reverse tunnel earning its keep.
Any one of these fires on plenty of benign activity. Two or three in sequence, on one host, inside a few minutes, is TerminalFix or something close enough that you want to look. PowerShell script block logging is what makes the obfuscated command readable after the fact, so turn it on if it is not already.
A confirmed hit is a lateral-movement incident
The reverse tunnel changes what cleanup means. A SOCKS5 proxy plus deliberate hunting for domain controllers and domain admin accounts means one pasted command has become a foothold on your internal network. The attacker can now reach internal hosts, ports, and services that were never exposed to the internet, using the victim's machine as the pivot. So a confirmed TerminalFix hit is not a malware removal ticket. It is a lateral-movement incident, and it should be handled like one: assume internal reconnaissance already happened, rotate any credentials the host could reach including domain admin, and hunt for the tunnel and any sessions it carried before you call the box clean. The pasted command is the least interesting part of this whole chain.
What to do this week
None of this requires a new product. It requires watching the sequence.
-
Enable PowerShell script block logging and ship it to your log pipeline, so an obfuscated one-liner is recoverable instead of invisible.
-
Write a correlation that pages when a terminal or PowerShell is spawned by a browser and is quickly followed by persistence or an outbound connection to a new domain.
-
Weight egress detection toward destination age and reputation plus connection lifetime, not just an allowlist. A keepalive-heavy 443 WebSocket to a domain first seen last week is worth a look even when the port is allowed.
-
Tell people the one rule that ends this entire class of attack: no real verification, update, or CAPTCHA ever asks you to paste a command into a terminal. If a site does, it is an attack, full stop.
ClickFix keeps working because it borrows the user's own hands to run the first command. Moving that command into the terminal buys the attacker quieter execution and a longer script, but it does not change the fix. Watch the sequence, log the shell, and treat the tunnel as the emergency. The fake checkbox was never the point.