TerminalFix adds a persistent network pivot to ClickFix attacks

A Microsoft-observed ClickFix campaign can leave a compromised Windows endpoint operating as a persistent proxy for other systems it can reach from its network position. That changes the risk from a one-off malware delivery to a multistage enterprise intrusion with reconnaissance, remote command capability and durable access.

Microsoft Security Research published its analysis on 28 August 2026 after Microsoft Threat Intelligence observed TerminalFix targeting organisations across multiple industries. Microsoft did not disclose victim numbers, countries or specific sectors, and did not attribute the activity to a criminal group or state-linked actor. It also did not say when the campaign began or whether the infrastructure described in its report remained active.

A familiar lure, a different execution route

TerminalFix begins on a compromised website displaying an imitation of a Cloudflare Turnstile verification interface. Interaction with the page puts an attacker-supplied command on the visitor’s clipboard and instructs them to paste and execute it in Windows Terminal or PowerShell. Microsoft’s report does not describe Cloudflare systems or the legitimate Turnstile service as compromised. The lure only copies its appearance.

Directing users to Terminal or PowerShell differs from traditional ClickFix activity that uses the Windows Run dialog. In both forms, the apparent verification step persuades the user to start the compromise. Microsoft did not identify exploitation of a Windows vulnerability as the initial-access mechanism, assigned no CVE and named no affected or unaffected Windows versions or builds.

After the user executes the command, a staged delivery process begins. The chain abuses the legitimate, signed Windows binary LockScreenContentServer.exe to sideload a malicious DLL. Later stages retrieve payload data concealed inside PNG images and reassemble executable components on the endpoint. These techniques conceal parts of the delivery chain without relying on a disclosed software flaw.

The malware then creates two persistence mechanisms: a Registry Run entry and a recurring scheduled task. It also collects information about the computer, its domain and the associated Active Directory environment. That reconnaissance can help the operator map an enterprise environment before taking further action through the compromised host.

The endpoint becomes a network pivot

The final implant documented by Microsoft establishes a Python-based TLS WebSocket reverse tunnel and supports remote command activity. According to Microsoft Security Research, the tunnel could allow an operator to identify and reach additional internal systems visible from the compromised device. The endpoint therefore provides more than local malware access. It can become a route to resources reachable from its position on the network.

The observed chain established persistent endpoint compromise, environment reconnaissance and deployment of the tunnel. Microsoft did not report confirmed lateral movement, sensitive-data exfiltration, ransomware deployment or public service disruption. The evidence establishes compromised-host and network-level access, but it does not establish exfiltration or a broader data breach.

This was observed campaign activity, not a proof-of-concept demonstration. Important details nevertheless remain undisclosed. Microsoft has not identified the number or location of affected organisations, how the websites displaying the lure were compromised, or the operator’s identity and motive. Its public report also does not establish whether the documented infrastructure remains active or whether all remediation work has been completed.

Separate ClickFix campaign targeted Australia

Australian organisations have faced the broader ClickFix technique, although there is no evidence in the research that TerminalFix itself has reached the country. On 7 May 2026, the Australian Signals Directorate’s Australian Cyber Security Centre warned of a separate campaign targeting Australian infrastructure and organisations across multiple sectors. That activity used compromised WordPress sites, fake Cloudflare prompts and clipboard-delivered PowerShell commands to distribute Vidar Stealer.

The ACSC findings demonstrate local exposure to the same underlying social-engineering pattern, but the campaigns should not be conflated. The Australian activity delivered an information stealer, while Microsoft’s TerminalFix investigation followed a multistage chain through persistence, Active Directory reconnaissance and deployment of a reverse tunnel.

Defence depends on controls and investigation, not patching

Because Microsoft did not disclose a product vulnerability, there is no TerminalFix patch or fixed Windows release to deploy. Its guidance instead centres on restricting the tools abused by the campaign. Organisations can use application control or Group Policy to limit Windows Terminal, PowerShell and the Run dialog for standard users who do not require them. Microsoft also recommends warnings for pasted multiline text in Windows Terminal and controls that stop unapproved native tools from launching scripts or payloads.

For visibility, defenders can enable PowerShell script-block logging, use Constrained Language Mode where feasible and enforce signed-script policies such as AllSigned or RemoteSigned. Microsoft also advises monitoring for LockScreenContentServer.exe running from a non-standard location or loading an unexpected local DLL, alongside endpoint network protection, web protection, cloud-delivered antivirus protection and browser reputation controls such as Microsoft Defender SmartScreen.

User education remains part of the response. Staff should understand that legitimate CAPTCHA and verification services do not require commands to be pasted into Terminal, PowerShell or the Run dialog. The ACSC separately recommends limiting untrusted browser scripting and clipboard writes, enforcing least privilege, using protective DNS and restricting unauthorised scripts and executables.

Microsoft has published Defender detections and hunting guidance for the observed activity. Where TerminalFix is confirmed, responders should treat the device as a possible network pivot, investigate what other systems were reachable from it and prioritise rotation of credentials accessible from that host. With no patch available, containment depends on identifying the full extent of the access rather than removing only the initially detected payload.

Analysing an endpoint as part of a wider enterprise network requires more than looking at the device in isolation. One way to develop that systems thinking is through The Hack Academy’s online cybersecurity training programme, whose listed subjects include networking and cybersecurity fundamentals, with self-paced learning and practical exercises alongside theory.