What if a website asked one of your employees to prove they were human by pasting a command into Windows Terminal?
That seemingly simple request is at the center of a sophisticated attack campaign Microsoft calls TerminalFix. The attack uses a fake Cloudflare CAPTCHA, PowerShell, a legitimate signed Windows executable, malware concealed inside PNG images, Active Directory reconnaissance, and ultimately a reverse tunnel into the victim’s network.
For business leaders, the important lesson is not that attackers have figured out how to hide malware inside pictures. It is how many legitimate Windows capabilities they can chain together after convincing a user to start the process.
Key Takeaway: TerminalFix demonstrates how attackers increasingly combine social engineering, trusted Windows tools, obfuscation, and legitimate processes to make detection harder. The malware may be concealed or unfamiliar, but the attacker still needs the endpoint to perform actions that can potentially be restricted before the intrusion becomes damaging.
Microsoft observed attackers compromising websites and displaying fake Cloudflare verification prompts that instructed victims to paste malicious commands into Windows Terminal or PowerShell.
Once the user complied, the command downloaded a ZIP archive and began a multi-stage attack.
Microsoft documented an attack chain that included:
The PNG technique is particularly interesting. The attackers encoded malicious components into image pixel data, then extracted and reconstructed those components after the images reached the endpoint. Microsoft says the source images were subsequently deleted, reducing forensic evidence.
But hiding the malware was only part of the strategy.
Because the compromised workstation can become a doorway into systems the attacker could not otherwise reach directly.
Microsoft found the malware performing domain trust discovery, identifying domain administrators, searching Active Directory users and computers, and probing systems with names associated with infrastructure such as databases, backup servers, gateways and mail systems.
The final implant established a SOCKS-style reverse tunnel over an encrypted WebSocket connection. Microsoft says this could allow the attacker to reach other systems visible from the compromised endpoint.
That changes the business risk considerably.
One employee workstation can potentially become a pivot point for credential theft, lateral movement, data theft or ransomware deployment. Microsoft specifically notes that these are typical possibilities during the hands-on-keyboard activity that can follow this type of access, although Microsoft did not report observing those downstream actions in the specific attack chain it analyzed.
User education matters, but relying on employees to recognize every convincing deception is a weak single point of failure.
TerminalFix starts with social engineering. Microsoft recommends training users not to paste commands from CAPTCHA pages into Terminal or the Windows Run dialog.
The broader numbers reinforce that recommendation. Verizon's 2026 Data Breach Investigations Report found that the human element was present in 62% of breaches, while social engineering represented 16% of breaches.
Training should absolutely remain part of the strategy.
But consider what happened here. One user made one bad decision, and the endpoint was then asked to execute scripts, load a malicious DLL, manipulate files, create persistence, perform reconnaissance and establish external communications.
A stronger security question is therefore not only:
How do we prevent someone from clicking or pasting the wrong thing?
It is also:
What is the endpoint allowed to do after that mistake occurs?
Yes. Detection and response technology can identify multiple parts of this attack chain, and Microsoft provides specific Defender detections and hunting queries for the campaign.
Microsoft documents detections covering ClickFix execution, unexpected DLL loading, suspicious scheduled tasks, Active Directory enumeration and tunneling activity.
Those capabilities are important.
But TerminalFix also illustrates why Detect and Respond should not be the only endpoint security strategy. The attacker intentionally uses techniques intended to make analysis more difficult, including steganography, obfuscated PowerShell, hidden directories, DLL sideloading, in-memory execution and legitimate signed Windows components.
The attacker is trying to make malicious activity look less obviously malicious.
Instead of depending entirely on identifying malicious code, organizations can also restrict the endpoint behaviors an attacker is permitted to perform.
Look again at TerminalFix.
The malicious payload may be hidden inside PNG files. Its hash could change. The command could be rewritten. The infrastructure could move. The attacker could change the delivery mechanism entirely.
But eventually the attack needs Windows to do something useful for the attacker.
It needs to execute PowerShell. Launch processes. Load code. Write files. Establish persistence. Perform reconnaissance. Communicate externally. Reach other systems.
Changing the attack does not necessarily change the endpoint actions the attacker ultimately needs in order to succeed.
Microsoft itself recommends restricting PowerShell, using application control, blocking unnecessary Run functionality, using constrained PowerShell language modes, and deploying attack-surface-reduction policies.
That is fundamentally about reducing execution freedom.
Isolation and Containment adds another prevention layer by restricting what applications and processes are permitted to do, even when the specific attack has not already been identified as malicious.
The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.
AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment. It is designed to restrict unauthorized endpoint behavior without requiring an attack to first be classified as malicious.
That does not mean AppGuard replaces EDR, user training, patching or other security controls.
It means organizations can combine detection with controls designed to reduce the usable Windows attack surface.
AppGuard does not need to know the name of every attack to restrict endpoint behaviors the attack may require.
The attack may be new. The actions it needs to perform on a Windows endpoint often are not.
Unknown does not automatically mean unstoppable.
TerminalFix should prompt organizations to examine what happens after an employee makes a mistake, not just how effectively they train employees not to make one.
TerminalFix is another reminder that attackers will continue changing how malicious code is delivered and concealed.
Today it may be malware hidden inside PNG images. Tomorrow it could be a completely different file, script, trusted application or AI-generated attack sequence.
Trying to recognize every possible attack remains important, but it is an increasingly difficult race.
A second strategy is to ask what the attacker must ultimately make the endpoint do and restrict those actions before they produce business impact.
The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.
Sources:
Microsoft Security Research: TerminalFix campaign
The Register: Attack hides malware in PNGs and drops custom reverse tunnel
Verizon Data Breach Investigations Report