A new TerminalFix campaign is using fake verification prompts to push Windows users into running malicious commands, according to The Register, which attributes the technical findings to Microsoft researchers. The report says the attacker is unknown, and Microsoft declined to tell The Register how many organizations were targeted or compromised, or which criminal crew may be behind the activity. TerminalFix is described as a variant of the broader ClickFix initial-access pattern: a social-engineering technique that tells users they need to run a command to fix a problem or complete a verification step. The Register reports that this variant steers victims toward Windows Terminal or PowerShell rather than the Windows Run dialog, increasing the chance that a victim will execute a longer, multi-line script. The lure begins with a fake overlay spoofing Cloudflare’s “verify you are human” CAPTCHA checkbox, including a Cloudflare logo, according to the report. When the victim interacts with it, a fake verification command is copied to the clipboard. The user is then induced to paste that command into Windows Terminal or PowerShell. From there, the attack becomes a multi-stage chain. The Register says the pasted command runs a hidden PowerShell script that displays a fake Cloudflare verification message, downloads a ZIP archive from an attacker-controlled server, extracts it under C:\ProgramData, and starts a batch file named 1.bat. That batch file silently launches LockScreenContentServer.exe. LockScreenContentServer.exe is a legitimate, signed Windows executable, but in this chain it is used as the host for DLL sideloading, according to the report. The companion file, dui70.dll, presents itself as a Windows DirectUI Engine component but is described as the malicious payload. Once sideloaded, it starts another PowerShell stage. That second-stage script is where the campaign adds a harder-to-inspect delivery method. The Register reports that the attacker hid additional payloads inside PNG image files, a steganographic technique meant to make file-type and content inspection less straightforward. The payload was split across three images: the first contained an executable, while the second and third carried two halves of a DLL that were later reassembled on disk. Microsoft researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan wrote, according to The Register, that the source images are deleted after extraction to reduce forensic artifacts. The report says the malware then establishes persistence through HKCU Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes, helping it survive reboots. The final result, as described by The Register, is a custom reverse tunnel on the infected machine. That gives the attacker persistent, network-level proxy access through the compromised device, while the same chain also includes Active Directory reconnaissance. The practical concern is not just the initial infection, but the use of a user’s own endpoint as a durable foothold into the surrounding network. Who benefits: Attackers benefit from a chain that blends user-initiated execution, legitimate Windows components and steganographic delivery. Those layers can make the activity harder to spot if defenses focus mainly on downloaded executables or obvious malicious attachments. Who's exposed: Windows environments are exposed where users can run Terminal or PowerShell commands and where monitoring does not catch suspicious clipboard-driven execution, DLL sideloading, HKCU Run persistence or recurring scheduled tasks. The report does not identify victim sectors or affected organization counts.