TerminalFix ClickFix Campaign

Technical Analysis

TerminalFix is a social-engineering-driven attack chain that abuses legitimate-looking fake CAPTCHA verification pages injected into compromised websites, prompting victims to open Windows Terminal (or Run dialog) and paste attacker-supplied PowerShell one-liners. Execution of these commands downloads and establishes reverse tunneling utilities (commonly leveraging tools like Cloudflare Tunnel, ngrok, or similar) that create outbound connections from the victim host to attacker infrastructure, evading inbound firewall restrictions and enabling command-and-control. This technique does not rely on a software vulnerability but on user-driven execution, making it effective against patched systems and difficult to detect via traditional exploit-based signatures. Because reverse tunnels grant attackers arbitrary remote code execution and file access on the compromised host, any AI agent frameworks, local LLM tool-execution environments, or automation scripts running on the infected machine could be hijacked, have their API keys/credentials exfiltrated, or be used as a pivot point to compromise connected RAG pipelines or downstream agent infrastructure.

Affected Systems

Windows systems with PowerShell and Windows Terminal access; end-user workstations browsing compromised or malicious websites; environments lacking script execution policy restrictions or endpoint detection for LOLBins

Indicators of Compromise

• Fake Cloudflare CAPTCHA verification pages on compromised websites
• Malicious PowerShell one-liner commands invoking Windows Terminal
• Reverse tunnel binaries/utilities dropped post-execution
• (Specific hashes, domains, and C2 IPs not disclosed in source reporting)

Remediation Steps

1. 1

   User Awareness Training

   Educate users to never copy-paste and execute commands from website prompts, especially fake CAPTCHA or verification pages requesting terminal/PowerShell interaction.

2. 2

   Restrict PowerShell Execution

   Implement PowerShell Constrained Language Mode, script execution policies, and application whitelisting to limit unauthorized script execution.

3. 3

   Monitor for Reverse Tunnel Tools

   Deploy EDR rules to detect and alert on execution of tunneling utilities (ngrok, Cloudflare Tunnel, etc.) and unusual outbound connections from endpoints.

4. 4

   Web Filtering and Browser Isolation

   Use web content filtering and browser isolation to block access to known compromised domains and suspicious CAPTCHA-mimicking pages.

5. 5

   Audit Agent Host Credentials

   For hosts running AI agent frameworks or automation tooling, rotate API keys and credentials if compromise is suspected, and isolate agent execution environments from general-purpose user workstations.