Microsoft is warning about a ClickFix variant called TerminalFix that uses fake Cloudflare CAPTCHA prompts on compromised websites to get victims to run malicious PowerShell commands, according to BleepingComputer. The campaign differs from many ClickFix attacks, which BleepingComputer says often lead to infostealer infections. In this case, the reported objective is a multi-stage intrusion chain that ultimately gives the attacker a reverse tunnel into the victim’s internal network. The initial social-engineering step is familiar: a fake CAPTCHA tells the user to complete a verification process. But the command has already been placed into the clipboard, and the victim is instructed to execute it through Windows Terminal or PowerShell. BleepingComputer reports that this TerminalFix approach enables more complex, multi-line scripts than typical ClickFix flows. The payload chain is layered. The PowerShell command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL. The DLL then decodes and runs an obfuscated payload directly in memory, according to the report. A second stage uses steganography. BleepingComputer says the attacker hid executable and DLL fragments inside the pixel data of three PNG images, which the script retrieves from the command-and-control server and reassembles on disk. Once installed, the malware reportedly creates persistence through both a scheduled task and a Registry Run key, configured to execute every hour. While active, it conducts reconnaissance by probing for domain controllers, databases, backup servers, gateways, mail systems, and by enumerating Active Directory. The most important component is a custom Python reverse-tunnel module, BleepingComputer reports. It connects outbound to gitnow[.]dev:443 over an encrypted WebSocket and supports SOCKS5-style arbitrary TCP proxying. That gives the operator a way to route connections through the compromised machine to internal IP addresses, hostnames, and ports reachable from that endpoint. Microsoft discovered the attacks in the wild but did not observe hands-on activity, according to the report. Even so, Microsoft warned that access obtained this way could be used for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware deployment. The recommended defensive posture is operational rather than purely signature-based: restrict and log PowerShell execution, monitor for LockScreenContentServer.exe outside its normal path, and harden browsers and endpoint protections. If compromise is confirmed, BleepingComputer says Microsoft advises investigating for lateral movement and rotating credentials, including domain administrator credentials if they were accessible from the infected host. Who benefits: Defenders get specific behaviors to hunt: unusual PowerShell execution, abnormal LockScreenContentServer.exe placement, scheduled-task and Registry Run persistence, and outbound encrypted WebSocket tunneling. Attackers benefit when users are allowed to execute complex scripts and compromised endpoints can reach valuable internal services. Who's exposed: Organizations are most exposed where users can be tricked into running PowerShell or Windows Terminal commands and where endpoints have broad internal network reach. Environments with weak PowerShell logging or limited post-compromise investigation may have less visibility into the tunnel stage.