New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal and PowerShell

Concept art representing cybersecurity principles.

• Microsoft warns of TerminalFix, a campaign abusing compromised sites with fake Cloudflare CAPTCHAs
• Victims paste malicious PowerShell commands, sideloading DLLs and deploying a Python implant
• Implant enables encrypted reverse tunnels, giving attackers pivot access into internal networks

Security researchers from Microsoft are warning of an ongoing malicious campaign that uses compromised websites to trick users into installing a powerful backdoor.