TerminalFix ClickFix Variant: Fake Cloudflare CAPTCHAs Push Reverse-Tunnel Malware via Windows Terminal — Detection and Defense Guide

Microsoft's threat intelligence team has disclosed a new evolution of the ClickFix social-engineering technique, dubbed TerminalFix. Where classic ClickFix lures direct victims to the Windows Run dialog (Win+R) to paste attacker-controlled commands, TerminalFix redirects them to Windows Terminal or PowerShell — a deliberate shift that lets operators deliver longer, more complex multi-stage commands that would never fit or survive in the Run dialog. The lures masquerade as Cloudflare CAPTCHA / "Verify you are human" pages, and the endgame is deployment of a reverse-tunnel unauthorized access mechanism that punches an outbound command-and-control channel back to the attacker, neatly bypassing inbound firewall restrictions.

This is not a vulnerability in Windows, PowerShell, or Cloudflare. There is no CVE to patch. The exploited component is the user, and the payload delivery mechanism is legitimate, signed Microsoft tooling. That is precisely what makes TerminalFix dangerous for enterprises: it sidesteps attachment sandboxing, URL rewriting, and most signature-based email controls, and it produces execution telemetry that looks like ordinary administrative activity unless your detections are tuned for it. Every organization with Windows endpoints and users who browse the web is in scope.

Technical Analysis

Attack Chain (Defender's View)

1. Lure delivery. The victim lands on a compromised or attacker-controlled site — via malvertising, SEO poisoning, phishing links, or injected content on legitimate sites. The page presents a pixel-perfect imitation of a Cloudflare Turnstile / "Checking your browser" CAPTCHA.
2. Clipboard injection. When the victim clicks the fake verification checkbox, JavaScript silently copies a malicious command to the clipboard (the classic ClickFix primitive, typically via navigator.clipboard.writeText()). The page then displays step-by-step instructions — but instead of the Run dialog, TerminalFix instructs the user to open Windows Terminal (wt.exe) or PowerShell and paste.
3. Execution under the user's context. The pasted command is typically a PowerShell one-liner using Invoke-Expression/iex against content fetched with Invoke-WebRequest/irm, often with obfuscation (Base64 -enc, string concatenation, or AMSI-bypass preamble). Because the user voluntarily executes it, SmartScreen, Mark-of-the-Web, and most EDR heuristic gates tied to file download provenance are bypassed.
4. Reverse-tunnel implant deployment. The staged payload establishes an outbound reverse tunnel (over HTTPS, WebSocket, or legitimate tunneling services such as Cloudflare Tunnel/trycloudflare, ngrok, or similar) to attacker infrastructure. From the network's perspective this is outbound 443 traffic — it blends with normal egress and requires no inbound firewall hole. The tunnel gives the operator interactive access for hands-on-keyboard follow-on activity: credential theft, lateral movement staging, and ransomware precursor behaviors.

Why the Terminal Pivot Matters

The Run dialog imposes practical limits: it truncates long commands, offers no scrollback, and generates a well-known telemetry signature (explorer.exe → child process with pasted command line). Moving to Windows Terminal/PowerShell gives attackers:

• Arbitrary command length and complexity — full multi-stage scripts, environment variable staging, encoded payloads.
• A plausible-looking context — users have been trained for years that "technical fix steps" involve a terminal window, so suspicion drops.
• Richer execution hosts — direct access to powershell.exe/pwsh.exe with the user's token, rather than a Run-dialog-spawned stub.

Affected Platforms

Any Windows 10/11 or Windows Server endpoint where users can launch Windows Terminal or PowerShell and reach the internet. No specific product version is vulnerable — the "vulnerability" is permissive script execution plus unfiltered egress.

Exploitation Status

Confirmed in the wild. Microsoft's disclosure describes active TerminalFix campaigns in current operations. This is an evolution of a proven technique family — ClickFix/TAB fixation lures have driven substantial intrusion volume through 2025–2026, including ransomware precursor access. There is no CISA KEV entry (no CVE exists), but defenders should treat this as an active, high-prevalence intrusion vector, not a theoretical one.

Detection & Response

The highest-fidelity detection surface is process creation telemetry with full command lines. Script Block Logging (Event ID 4104) and PowerShell transcription are essential companions. The rules below target the specific behaviors TerminalFix exhibits: user-launched shells running download-and-execute patterns, encoded commands, and reverse-tunnel tooling.

---
title: TerminalFix - User-Launched Shell Download-Cradle Execution
id: 3f8a1c42-7b5d-4e91-a2c6-9d0e5f7b1234
status: experimental
description: Detects PowerShell or Windows Terminal executing download-and-execute cradle patterns consistent with ClickFix/TerminalFix clipboard-pasted commands.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wt.exe'
      - '\WindowsTerminal.exe'
  selection_cradle:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iwr '
      - 'irm '
      - 'curl.exe'
      - 'DownloadString'
      - 'Start-BitsTransfer'
  condition: selection_img and selection_cradle
falsepositives:
  - Legitimate administrative automation and software deployment scripts
  - Developer tooling bootstrap commands
level: high
---
title: TerminalFix - Encoded or Obfuscated PowerShell From Interactive Shell
id: 9c2d7e15-4a3b-48f6-b1d8-6e5c0a9f2468
status: experimental
description: Detects Base64-encoded or obfuscated PowerShell execution, a common TerminalFix second stage after a fake Cloudflare CAPTCHA lure.
references:
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - ' -EncodedCommand'
      - 'FromBase64String'
      - '-w hidden'
      - '-WindowStyle Hidden'
  filter_known_admin:
    ParentImage|endswith:
      - '\sccm\'
      - '\intune\'
  condition: selection and not filter_known_admin
falsepositives:
  - Encoded commands used by legitimate management tooling (SCCM, Intune, some EDR response actions)
level: high
---
title: TerminalFix - Reverse Tunnel Tool Execution or Beaconing
id: 5b1e9f30-8c4a-4d27-93e5-2f6a7c0d5e91
status: experimental
description: Detects execution or network use of reverse-tunneling utilities (cloudflared, ngrok, chisel, ligolo) commonly deployed by TerminalFix operators for outbound C2.
references:
  - https://attack.mitre.org/techniques/T1572/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1102
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\cloudflared.exe'
      - '\ngrok.exe'
      - '\chisel.exe'
      - '\ligolo-agent.exe'
      - '\frpc.exe'
  selection_domain:
    CommandLine|contains:
      - 'trycloudflare.com'
      - 'ngrok.io'
      - 'serveo.net'
      - 'localhost.run'
  condition: selection_proc or selection_domain
falsepositives:
  - Developer and DevOps use of tunneling tools for testing
level: high

Tune the third rule to your environment: if your DevOps teams legitimately use cloudflared, scope the rule to workstations or alert only when the parent is a shell spawned outside your management plane.

Microsoft Sentinel / Defender KQL

This hunt correlates interactive shell launches with download-cradle command lines and outbound connections to tunneling infrastructure — the full TerminalFix chain in one query.

let lookback = 7d;
let suspiciousCmd = dynamic(["iex", "Invoke-Expression", "irm ", "iwr ", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "-enc", "-WindowStyle Hidden", "Start-BitsTransfer"]);
let tunnelIndicators = dynamic(["trycloudflare.com", "ngrok.io", "cloudflared", "chisel", "serveo.net", "localhost.run"]);
let ShellExec = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wt.exe", "WindowsTerminal.exe")
| where ProcessCommandLine has_any (suspiciousCmd)
| project ShellTime=TimeGenerated, DeviceName, DeviceId, AccountName, ShellCmd=ProcessCommandLine, ShellProcessId=ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine;
ShellExec
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (tunnelIndicators) or RemoteIP in (""
    ) or InitiatingProcessCommandLine has_any (tunnelIndicators)
    | project NetTime=TimeGenerated, DeviceId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
) on DeviceId
| where isempty(RemoteUrl) or NetTime between (ShellTime .. ShellTime + 10m)
| summarize FirstSeen=min(ShellTime), Commands=make_set(ShellCmd), TunnelDestinations=make_set(RemoteUrl) by DeviceName, AccountName
| order by FirstSeen desc

Also hunt Command-and-Scripting Interpreter events via SecurityEvent 4688 where NewProcessName ends in powershell.exe and CommandLine contains clipboard-paste hallmarks (long single-line commands executed within minutes of browser activity from msedge.exe/chrome.exe parentage chains).

Velociraptor VQL

This artifact sweeps endpoints for live suspicious shell processes and tunneling-tool binaries in user-writable locations — both fast triage for a suspected TerminalFix hit.

-- TerminalFix triage: suspicious shells and reverse-tunnel binaries
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)powershell|pwsh|wt\.exe|WindowsTerminal'
   AND CommandLine =~ '(?i)iex|Invoke-Expression|irm |iwr |DownloadString|-enc|WindowStyle Hidden')
   OR Name =~ '(?i)cloudflared|ngrok|chisel|frpc|ligolo'

LET binaries = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/AppData/**/cloudflared.exe',
                 'C:/Users/*/AppData/**/ngrok.exe',
                 'C:/Users/*/Downloads/*.exe',
                 'C:/ProgramData/**/*.ps1'])
WHERE Mtime > now() - 604800

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'FILE_ARTIFACT' AS Name, FullPath AS CommandLine,
       FullPath AS Exe, NULL AS Username, Mtime AS CreateTime
FROM binaries

Hardening & Verification Script

Run this on endpoints (or deploy via Intune/GPO) to enable the logging that makes TerminalFix detectable and to constrain the execution paths it depends on.

# TerminalFix defensive hardening - run elevated
# 1) Enable PowerShell Script Block Logging and Module Logging
$sbPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
New-Item -Path $sbPath -Force | Out-Null
Set-ItemProperty -Path $sbPath -Name 'EnableScriptBlockLogging' -Value 1
$modPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
New-Item -Path $modPath -Force | Out-Null
Set-ItemProperty -Path $modPath -Name 'EnableModuleLogging' -Value 1

# 2) Enable process creation command-line auditing (Event 4688 with cmdline)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

# 3) Verify PowerShell Constrained Language Mode readiness (deploy via WDAC/AppLocker for enforcement)
Write-Host "[!] Deploy WDAC or AppLocker rules to enforce Constrained Language Mode for standard users."
Write-Host "[!] Block or alert on: cloudflared.exe, ngrok.exe, chisel.exe for non-DevOps users."

# 4) Confirm AMSI is operational for PowerShell
$amsiTest = Invoke-Expression "'AMSITEST' -match 'AMSI'"
Write-Host "[+] AMSI integration present: $amsiTest"

# 5) Check current logging status
Get-ItemProperty -Path $sbPath | Select-Object EnableScriptBlockLogging
Write-Host "[+] Verify Event IDs 4104 and 4688 are flowing to your SIEM before considering this complete."

Remediation

There is no patch — defense is layered and behavioral:

1. User awareness (immediate). Brief staff this week on the specific lure: no legitimate CAPTCHA — Cloudflare or otherwise — will ever ask you to open Windows Terminal or PowerShell and paste a command. That single sentence, internalized, kills the entire technique. Include a screenshot of the fake verification page in your awareness material.
2. Constrain script execution. Deploy WDAC or AppLocker to enforce PowerShell Constrained Language Mode for standard users and block unauthorized binaries. Block or heavily alert on tunneling tools (cloudflared, ngrok, chisel, frpc, ligolo) outside approved DevOps roles.
3. Egress control. Reverse tunnels die without egress. Restrict outbound 443 to categorized destinations via proxy, block known tunneling service domains (trycloudflare.com, *.ngrok.io) where the business doesn't require them, and alert on new/long-lived outbound TLS sessions from workstations.
4. Telemetry completeness. Confirm Script Block Logging (4104), Module Logging (4103), and 4688-with-command-line are enabled and shipped to your SIEM. Without 4104 you are blind to the obfuscated second stage.
5. Browser-side mitigation. Consider browser isolation for high-risk users and policies that alert on or block pages invoking clipboard-write APIs on non-allowlisted sites.
6. Response playbook. If a hit fires: isolate the host, collect PowerShell history (ConsoleHost_history.txt), prefetch, and 4104 logs; identify what the reverse tunnel carried; assume credential exposure and reset credentials used on the host; hunt fleet-wide with the VQL above for the same tooling.

Monitor Microsoft's security blog and The Hacker News source article for published IOCs and add them to your blocklists as they emerge.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub