# TerminalFix: The ClickFix Clone That Figured Out the Run Dialog Was Too Obvious
There's a telltale sign that a social engineering technique has gotten too well-known: attackers start building a better version of it.
ClickFix — the clipboard-hijacking trick that convinced thousands of users to paste malicious commands into the Windows Run dialog — has spawned a nastier offspring. Microsoft's threat intelligence team is calling it TerminalFix, and the upgrade is deliberate. Fake Cloudflare CAPTCHA prompts guide victims past the Run dialog entirely, straight into Windows Terminal or PowerShell, where the command waiting for them isn't just a dropper — it's a reverse-tunnel backdoor.
That evolution is worth sitting with for a moment. The attackers looked at a technique that was working, identified its single biggest liability (Run dialog prompts look suspicious to anyone who's been around), and swapped it for an environment that looks, to a non-technical user, like it belongs there.
## Why the Terminal Swap Is a Real Upgrade
The Windows Run dialog is a relic. Nobody who isn't doing IT work thinks about it day to day, and security awareness training has gotten decent at flagging it as a red-alert moment. "Don't paste commands into the Run box" is, at this point, a thing some people actually know.
PowerShell and Windows Terminal are different. They're present in corporate environments. Developers use them constantly. IT staff use them constantly. And critically, PowerShell is capable of executing commands in ways that the Run dialog simply isn't — chaining multiple operations, pulling remote scripts, manipulating the local system state quietly, and doing it all in a window that closes before anyone gets a good look.
Microsoft's disclosure notes that TerminalFix campaigns increase "the likelihood that complex" commands will run successfully. That phrasing is understated. What they mean is: PowerShell can do things in a single command that would require a multi-stage infection chain through the Run dialog. Attackers aren't just switching windows. They're switching to a more powerful weapon.
The reverse-tunnel backdoor element is the part that should worry defenders most. Rather than calling out to a hardcoded C2 IP — something that network monitoring tools and threat intel feeds can catch — a reverse-tunnel establishes an outbound connection that punches through firewalls and NAT. The attacker's server waits; the infected endpoint reaches out. Standard perimeter defenses that look for inbound connections largely miss it.
Tools in this space (ngrok, Cloudflare Tunnel, frp, chisel) are legitimate DevOps software. Many organizations already allow outbound HTTPS to Cloudflare infrastructure. A TerminalFix payload that piggybacks on that trust is effectively invisible to anything that isn't doing deep behavioral analysis.
## The CAPTCHA Is the Con
The delivery mechanism — fake Cloudflare verification pages — is doing a lot of heavy lifting here, and it's genuinely clever.
Cloudflare's "Checking if the site connection is secure" page is one of the most frequently encountered interstitials on the modern web. Users see it dozens of times per month. Their brains have been trained to wait, click, and move on. The friction is expected. The page looks like infrastructure, not like an attack.
What TerminalFix does is reproduce that visual with a critical difference: instead of a checkbox or a background challenge, the "verification" step instructs the user to open PowerShell and paste a command to prove they're human. The framing is absurd if you understand what's happening. If you don't, it reads as plausible — maybe a bit unusual, but you've never thought hard about how CAPTCHAs work, and this website seems legitimate enough, so.
This is the core of ClickFix's staying power: it exploits the gap between how computers actually work and how most users mentally model them. The CAPTCHA wrapper doesn't need to be technically convincing. It just needs to be contextually convincing, and Cloudflare's brand provides a lot of that context for free.
## The Broader ClickFix Problem
TerminalFix is the latest in a line of ClickFix evolutions that have been accelerating since late 2023. What started as a niche technique associated with a handful of crimeware operations has since been adopted by nation-state actors — including groups tied to North Korea and Iran — as a reliable initial-access method. The Lazarus group has used ClickFix variants in job-lure campaigns targeting cryptocurrency developers. Iranian-linked actors have deployed it against defense sector targets. The technique has shown up in ransomware pre-infection stages and in targeted espionage operations.
The reason it keeps spreading is the same reason phishing keeps spreading: it works on people, not on software. Every endpoint protection tool, every email gateway, every browser sandboxing layer is built around the assumption that malware arrives uninvited. ClickFix inverts that. The user performs the infection themselves, voluntarily, because they were convinced it was the right thing to do. Traditional detection isn't calibrated for that.
TerminalFix adds the PowerShell escalation and the tunnel backdoor, but the fundamental attack surface is unchanged: trust, familiarity, and the half-second of decision-making most people apply when a webpage asks them to do something.
## What Defenders Can Actually Do
This isn't a patch situation. There's no CVE to apply, no zero-day to remediate. The mitigations are behavioral and architectural.
For most organizations:
At the network layer:
---
## HackWire Analysis
The real story here isn't the technique itself — it's what the technique reveals about the direction attackers are heading.
TerminalFix is the third significant ClickFix variant in under two years. Each iteration has patched a weakness of its predecessor: first it was the suspicious Run dialog, now it's the limited command capability of that context. The next version will almost certainly address the remaining friction points — maybe a more convincing pretext than a CAPTCHA, maybe delivery through a compromised but legitimate domain, maybe deeper integration with browser-level social engineering.
What this pattern maps to is the professionalization of initial-access tradecraft. The same optimization cycle that runs through ransomware-as-a-service operations is now running through social engineering frameworks. Attackers are iterating on UX.
The reverse-tunnel backdoor component also deserves more attention than it's getting in most write-ups. Organizations that have invested in traditional perimeter security — firewall rules, IDS, outbound filtering — are operating on a threat model that assumes C2 traffic looks like C2 traffic. Reverse tunnels wrapped in HTTPS to a CDN provider shred that assumption. This is infrastructure designed specifically to evade the controls that most mid-market companies have actually deployed.
Security teams should treat any ClickFix variant detection as an immediate incident, not a low-severity alert. By the time a user has opened Terminal and pasted a command, you're not in a malware prevention scenario anymore — you're in a compromise response. The detection window is short and the blast radius depends entirely on what the reverse tunnel gets used for in the next 15 minutes.
— HackWire Editorial
---
## Related Coverage