SECURITY Signal 51
TerminalFix ClickFix variant hides malware in PNGs and deploys custom reverse tunnel via PowerShell
↗
A new ClickFix variant called TerminalFix tricks users into running PowerShell commands through fake Cloudflare CAPTCHA overlays, launching a multi-stage attack that uses DLL sideloading and PNG steganography to establish a persistent reverse tunnel on compromised machines.
This campaign shifts ClickFix social engineering from the Windows Run dialog to Windows Terminal and PowerShell, increasing the likelihood that users execute multi-line scripts unknowingly. The combination of steganographic payload delivery, redundant persistence mechanisms, and Active Directory reconnaissance gives attackers persistent network-level proxy access through compromised devices, making detection and forensic analysis significantly harder.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
TerminalFix directs victims to Windows Terminal or PowerShell rather than the Windows Run dialog used by traditional ClickFix attacks.
The attack chain uses DLL sideloading via a legitimate signed Windows executable and hides payloads across multiple PNG images using steganography.
Persistence is maintained through registry keys and scheduled tasks running every 60 minutes, with Active Directory reconnaissance and a file-watch loop for remote command execution.
THE CLUSTER