The page says prove you are human. The victim clicks a Cloudflare-branded checkbox, which quietly copies a command into their clipboard, and then follows on-screen instructions that walk them through pasting and running it. It is a familiar routine by now. What is different this time is where it ends: not with a password stealer, but with a hidden encrypted tunnel out of the network that the attackers can use as a way back in.
Microsoft has published details of the campaign and calls it TerminalFix. The social engineering is close enough to the ClickFix technique that a defender could easily file it under the same heading and move on, which is the mistake worth avoiding here.
Pictures that are also programs
Once the pasted command runs, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites. The images are real images. They also carry a payload buried in the pixel data. A PowerShell script reads that data back out: the first eight bytes give the length of the embedded file, and the remainder is reconstructed into an executable and two DLL fragments that are joined together on the victim's disk.
Hiding code in image pixels, a technique known as steganography, is notable but not novel; other ClickFix campaigns have used the same trick. What separates TerminalFix, in Microsoft's account, is that it chains together several mature evasion techniques at once rather than leaning on a single obfuscated downloader. That chain includes DLL sideloading, the steganographic delivery, hidden folders, rotating realistic browser user agents, and encrypted WebSocket traffic.
Why the tunnel is the story
ClickFix victims almost always end up with information-stealing malware of one sort or another. TerminalFix does something else. The payload chain performs domain-aware reconnaissance, working out what kind of network it has landed in, then installs a custom multiplexed reverse TCP tunnel.
Both halves of that phrase matter. Reverse means the infected machine dials out to the attackers rather than waiting to be contacted, and it does so over port 443 in traffic that looks like ordinary encrypted web browsing, so a corporate firewall watching for inbound connections has nothing to block. Multiplexed means the attackers can push several separate connections through that one encrypted channel at the same time, reaching a file server, a database and another workstation in parallel. The compromised desktop stops being the target and becomes the stepping stone.
Real CAPTCHAs do not ask for PowerShell
The defence here is unglamorous and it works. A genuine CAPTCHA may ask you to click boxes or pick out images. It will never ask you to open Run, Terminal, Command Prompt or PowerShell and paste something in. That single rule ends the entire chain before it starts.
The rest is about slowing people down, because these pages are built to prevent exactly that. Countdown timers, live user counters and other urgency cues are there to stop anyone thinking. Do not run commands copied from a web page, an email or a message unless you understand what they do. Typing a command by hand instead of pasting it removes the risk of running something hidden in the copied text. If a site instructs you to perform a technical action, verify it against official documentation or support first.
Some platform help is arriving too. Browser extensions can warn when a page writes to the clipboard, some browsers now restrict or flag certain clipboard uses, and since macOS Tahoe 26.4 the Terminal can warn a user when they paste text copied from a browser or messaging app, at the operating system level rather than inside the browser.
The details above come from Microsoft's research, written up by Malwarebytes; Microsoft's own report carries the primary technical detail. It is the latest turn in a technique we have watched broaden from fake fix prompts harvesting browser logins to a shared loader behind fake download pages. The lure has stayed the same for a year. The payload behind it keeps getting more ambitious.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.