TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft analyzes the TerminalFix Windows malware campaign, which lures victims with fake Cloudflare CAPTCHAs that copy malicious commands to the clipboard; once executed, the malware reconstructs payloads hidden in PNG images via steganography, uses PowerShell, DLL sideloading, folder hiding and realistic User-Agent rotation, and establishes encrypted WebSocket command-and-control over port 443 to create a multiplexed reverse TCP tunnel for domain-aware reconnaissance and lateral access. The report highlights the campaign's advanced evasion techniques and provides user-focused mitigations such as not running copied commands, using up-to-date anti-malware, and browser protections like Malwarebytes Browser Guard.