Microsoft warns of ClickFix campaign exploiting Windows Terminal to deliver Lumma Stealer

Microsoft and SecurityAffairs report a ClickFix campaign (February 2026) that tricks users into launching Windows Terminal and pasting hex-encoded, XOR-compressed PowerShell commands from fake CAPTCHAs or prompts; the decoded script downloads and runs multi-stage payloads culminating in a Lumma Stealer component that injects into browser processes, harvests stored credentials, establishes persistence, and exfiltrates data to attacker infrastructure.