Microsoft has documented a campaign it calls TerminalFix. It is the ClickFix technique with a single change, and the change is not technical.

ClickFix shows you a fake verification page, tells you the page will not load until you run a command, and asks you to paste it into the Run dialog. TerminalFix asks you to paste it into Windows Terminal or PowerShell instead.

In Microsoft's words, the campaigns apply the same technique but direct users to Windows Terminal or PowerShell, increasing the likelihood that complex, multi-line scripts execute successfully.

Why that one substitution matters

The Run dialog is a single line. It mangles long commands, it does not handle multi-line input, and a script complicated enough to do something useful frequently fails there.

Windows Terminal does not have that problem. It takes anything.

So the attacker's constraint was never the victim's willingness — people paste the command either way. The constraint was that the command had to be short enough to survive the box they were pasting into. Moving the instruction to Terminal removes the size limit on the payload, and everything downstream gets bigger.

There is no vulnerability anywhere in this. Nothing is exploited. A person is asked to run something and does. That is why patching does not help and why it works on any version of Windows.

The chain, once you paste

The command pulls a ZIP containing two files: LockScreenContentServer.exe, a legitimate signed binary, and dui70.dll, which is not.

The legitimate binary loads the malicious DLL — DLL side-loading, the same technique Sleepwalker used through a security vendor's own management agent. From there:

  • Next-stage payloads are retrieved hidden inside PNG images from external domains
  • Persistence via Registry Run keys and scheduled tasks
  • Reconnaissance: system metadata, domain trust discovery, enumeration of domain admins, Active Directory searches for users and computers, and pings to nameservers to map the internal network

Then the part that matters.

The reverse tunnel is the payload

The final stage is a Python implant, client.py, which opens an encrypted WebSocket connection outbound to gitnow[.]dev on port 443.

Microsoft's assessment is that this is particularly dangerous because it gives attackers direct access to an organisation's internal network through the reverse tunnel.

Read that precisely. It is not that one workstation is compromised. It is that the command server can now reach anything that workstation can see — every internal service that trusts a machine on the corporate network, without any of them being individually attacked.

Note also the direction of travel: outbound, on 443, to a domain that reads like developer infrastructure. There is no inbound connection to block and no unusual port to notice.

What to do

  • Tell people the rule, not the indicators. No legitimate website, CAPTCHA or error page ever asks you to paste a command into a terminal. That single sentence defeats the entire technique and does not expire when the lure changes.
  • Restrict who can run PowerShell interactively. Most staff have no reason to.
  • Enable PowerShell script block logging if it is off. This chain is invisible without it.
  • Watch for LockScreenContentServer.exe outside its normal path, and for dui70.dll loaded from a user-writable directory.
  • Look for outbound WebSocket connections to unfamiliar developer-sounding domains. The tunnel is the thing worth catching, because it is the thing that scales.
  • Do not rely on the CAPTCHA looking wrong. It is a copy of a real Cloudflare page.

What is not established

  • How the websites serving the fake CAPTCHAs were compromised.
  • Who is behind it. No attribution.
  • How many organisations were infected. No figure.
  • Which sectors were actually hit, beyond "multiple".
  • The campaign's timeline. Not specified.