Microsoft spots ClickFix campaign getting users to self-pwn on Windows Terminal

Microsoft Threat Intelligence observed a ClickFix campaign that instructs victims to open Windows Terminal (Win+X → I) and paste encoded PowerShell commands; the commands download a renamed 7‑Zip utility to extract payloads that establish persistence, alter Microsoft Defender exclusions, collect system and browser data, and ultimately deploy the Lumma stealer to harvest browser-stored credentials. An alternate infection chain fetches a batch script that drops and runs a VBScript via MSBuild and uses a cryptocurrency 'EtherHiding' technique before executing the credential-theft routine. Attackers are adapting the ClickFix playbook to use Windows Terminal to evade detections tied to the Run dialog.