'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

A new ClickFix-style campaign, dubbed 'TerminalFix,' is leveraging PowerShell to deploy complex attacks against enterprise networks. Threat actors trick users into opening PowerShell and executing malicious commands, often through fake Zoom calls or browser troubleshooting prompts, to establish a foothold and then deploy sophisticated payloads, including reverse tunnels for persistent access and data exfiltration. Microsoft researchers highlight the campaign's danger due to the ability to bypass traditional defenses and install ransomware.

Threat actors are presenting potential victims with instructions to "fix" a problem, complete a verification step, or troubleshoot a browser issue by running a command supplied by the attacker. One variant sees the attacker drawing potential victims into a fake Zoom call through a browser; technical problems arise with sound or video, and victims are told they must paste a command to fix the issue.

Microsoft recently detailed the campaign, noting that directing users into PowerShell increases the likelihood that longer, more complex scripts execute successfully. This complexity facilitates attacks against larger enterprises easier than a "straightforward" ClickFix attack would, as the campaign targets organizations across multiple industries, according to Microsoft researchers. The initial PowerShell command downloads and launches a zip archive containing a malicious DLL for sideloading, which kicks off the rest of the attacker's complex attack chain. It downloads payloads concealed inside PNG images, establishes dual persistence through Registry Run keys and scheduled tasks, conducts domain reconnaissance, and deploys a "Python-based reverse-tunnel C2 implant that tunnels arbitrary TCP traffic back through an encrypted WebSocket channel to attacker infrastructure."

Microsoft researchers noted the campaign was "particularly dangerous" because the reverse tunnels give the threat actors direct access to the victim organizations' internal networks. "In the hands-on-keyboard phase that typically follows, attackers leverage this access to escalate privileges, disable security controls, exfiltrate sensitive data, and deploy ransomware across the organization," the researchers wrote.

Some skepticism has been raised regarding the naming of the campaign. While Microsoft describes TerminalFix as a variant of ClickFix, Proofpoint senior threat researcher Tommy Madjar argues that the use of Terminal windows dates back to some of the earliest ClickFix activity documented in 2024. "A terminal can accept longer, multiline scripts," he tells Dark Reading, "but the same multistage intrusion could just as easily begin with a short command pasted into Run that retrieves the next stage. Combined with the basic HTML lure and execution flow, Microsoft’s example does not stand out from established clusters such as ClearFake or ErrTraffic."

Microsoft's blog post makes a number of recommendations to users. For one, organizations should restrict PowerShell and Run dialog execution for standard users through methods like Group Policy, Application Control for Windows, or AppLocker. Organizations may also want to restrict the Windows Run dialog where not required for daily work and monitor for DLL sideloading indicators.