A ClickFix-style campaign called TerminalFix deploys multistage PowerShell attacks incorporating reverse tunnels into victim networks, Dark Reading disclosed August 31. The campaign tricks users into copying and executing malicious PowerShell commands disguised as legitimate troubleshooting steps, then establishes persistent access via reverse tunneling for command-and-control communication.
ClickFix Social Engineering Delivers Malicious PowerShell Commands as Troubleshooting Steps
ClickFix-style campaigns present users with fake error messages or system prompts that include PowerShell commands to “fix” the issue. Users are instructed to copy and paste the provided command into a terminal window, which then executes malicious code under the guise of resolving a technical problem.
TerminalFix demonstrates sophisticated PowerShell weaponization tactics targeting enterprise environments. The campaign’s multistage attack chain suggests a level of planning and infrastructure beyond opportunistic malware distribution, with each stage designed to evade detection while establishing persistent access.
Reverse Tunneling Establishes Persistent Command-and-Control Access to Corporate Networks
The campaign incorporates reverse tunnels to establish persistent access into victim networks. Reverse tunnels allow attackers to bypass firewall restrictions by initiating outbound connections from the compromised host that create a communication channel back to attacker-controlled infrastructure.
This technique is particularly effective in enterprise environments where outbound connections are less scrutinized than inbound traffic. Once the reverse tunnel is established, attackers gain a persistent command-and-control channel that appears as legitimate outbound traffic and does not require opening inbound firewall ports.
Multistage PowerShell Attack Chain Demonstrates Sophisticated Weaponization Beyond Basic ClickFix
The TerminalFix campaign’s multistage attack chain distinguishes it from basic ClickFix operations that rely on a single malicious command. Each stage in the TerminalFix chain serves a distinct purpose — initial execution, persistence establishment, reverse tunnel setup, and command-and-control communication — suggesting a level of planning and infrastructure investment beyond opportunistic malware distribution.
The sophistication of the PowerShell weaponization indicates the attackers have invested in developing evasion techniques, persistence mechanisms, and C2 infrastructure specifically designed to operate within enterprise environments where security teams monitor for malicious PowerShell activity.
Enterprise Environments Face Dual Risk from Social Engineering and PowerShell Execution Policies
TerminalFix exploits two common enterprise security gaps: user susceptibility to social engineering and PowerShell execution policies that permit script execution. Organizations that allow users to run PowerShell commands without restriction face increased risk from ClickFix-style attacks, which bypass traditional malware delivery mechanisms by convincing users to manually execute the payload.
Security teams should monitor for suspicious PowerShell execution, particularly commands that establish network connections, download additional payloads, or create scheduled tasks. Dark Reading’s disclosure of the TerminalFix campaign highlights the need to educate users on ClickFix social engineering tactics, which present malicious commands as IT-sanctioned troubleshooting steps.
ClickFix Tactic Evolution from Consumer to Enterprise-Targeted Campaigns
ClickFix-style attacks originally targeted consumer users with fake browser or software update prompts. The TerminalFix campaign’s focus on enterprise environments and incorporation of reverse tunneling infrastructure marks an evolution toward more sophisticated, persistent attacks that aim for long-term access rather than immediate payload delivery.
Organizations must treat user-initiated PowerShell execution with the same scrutiny applied to email attachments and downloads. The TerminalFix campaign demonstrates that attackers have adapted ClickFix social engineering to bypass endpoint detection and email filtering by moving the execution decision to the user, who manually pastes and runs the malicious command.
Dark Reading’s August 31 disclosure provides security teams with indicators to detect TerminalFix activity, but the campaign’s reliance on social engineering means technical controls alone are insufficient. Organizations must educate users to recognize ClickFix tactics — particularly prompts that instruct users to open PowerShell or Command Prompt and paste provided commands to resolve errors or install updates.
The incorporation of reverse tunneling into the TerminalFix attack chain suggests the campaign’s goal is long-term enterprise network access rather than immediate data theft or ransomware deployment. Organizations that detect suspicious PowerShell execution should investigate for reverse tunnel establishment, scheduled task creation, and outbound connections to attacker-controlled infrastructure, as these indicate the TerminalFix attackers have established persistent access and may be preparing for follow-on intrusion activity.
