September 6, 2026 · Security-Advisory · BSI · Social Engineering · Ransomware · Awareness

TerminalFix: When Employees Paste the Attack Themselves

Germany's BSI warns about the TerminalFix campaign. A fake CAPTCHA gets staff to paste a PowerShell command – and what remains is a tunnel into the network.

On 4 September 2026, Germany’s Federal Office for Information Security (BSI) published a cyber security warning at level 2 of 4: German institutions have been compromised through the TerminalFix campaign. The trigger was an incident reported in August 2026 – according to the BSI, the compromise of a state institution’s network.

What is remarkable about this campaign is what it lacks: a vulnerability. There is no patch you could apply. The attack does not arrive through an unclosed hole, but through the hands of an employee doing something that was plausibly explained to them.

How the attack unfolds

It starts with a prepared website. Users arrive there via phishing or social engineering – or the site is simply one they visit regularly (water holing). There, a prompt asks them to complete a CAPTCHA check. In the variant Microsoft analysed on 28 August 2026, this is a convincing replica of a Cloudflare overlay, complete with logo, checkbox and spinner animation.

The decisive step happens invisibly: the click copies a malicious PowerShell command to the clipboard. The on-screen instructions then guide the user to open Windows Terminal or PowerShell and paste it. To keep suspicion down, the page reports the CAPTCHA check as successful – and the terminal prints a reassuring success message.

What follows needs no further help. The command downloads an archive containing a legitimate, signed Windows binary and a manipulated DLL; the two work together through DLL sideloading. In the background, the DLL fetches PNG image files from the attacker infrastructure that carry further malicious code, assembled on the system only once it arrives. Persistence comes from a registry entry, a scheduled task recurring every hour, and hidden directories.

Only then does the real work begin: the malware surveys domains, permissions, Active Directory, the servers in operation and – explicitly – any backup systems. The attacker may then set up online storage, for instance in the Azure cloud, to move data there later, using the cloud provider’s own tooling. Finally a Python runtime is installed that opens a WebSocket connection over TLS on port 443 to the attackers’ infrastructure. The BSI points out a detail that matters for any later investigation: commands the attacker issues through this runtime may not be logged.

Why this is not simply ClickFix

The fake CAPTCHA trick has been known for some time under the name ClickFix. According to the Microsoft Digital Defense Report 2025, ClickFix was the most common initial access method observed by Microsoft’s Defender Experts during the reporting period, at 47 percent – ahead of phishing at 35 percent. ESET counted a 108 percent rise in ClickFix detections between the second half of 2025 and the first half of 2026.

The difference sounds technical and is nonetheless the heart of the matter. Classic ClickFix usually sends the victim to the Windows Run dialog. That dialog is single-line. TerminalFix sends them to Windows Terminal or PowerShell instead – where, as Microsoft writes, complex, multi-line scripts also execute reliably. The ceiling on what a user accomplishes for the attackers in a single step rises considerably.

The BSI draws the operational consequence: whereas ClickFix typically compromised individual machines, TerminalFix offers the possibility of penetrating deeper into networks and affecting the confidentiality, availability and integrity of an entire organisation’s IT. In practice this means a cleaned-up single machine is no longer a completed incident response.

What is established – and what is not

Precision pays here, because the sources are not uniform.

Microsoft describes the technical chain up to the back channel into the network, and states explicitly that it did not observe the downstream steps in the chain it analysed. The BSI adds, from the reports it received, that attempts were made to install ransomware and to exfiltrate data as part of double extortion. The two do not contradict each other – they are two different bodies of evidence.

On attribution, Microsoft names no one. The reports received by the BSI indicate the use of malware called LoremIpsumLoader; according to the BSI’s assessment, this malware is attributed to the same financially motivated group responsible for the Rhysida ransomware and leak site. The German incident reports themselves are not public – the attribution is therefore the BSI’s assessment, not an analysis that can be followed from outside. The BSI states that it has so far been unable to establish any connection to state-sponsored or politically motivated actors.

Two figures from the BSI warning are more useful for risk assessment than any threat rhetoric: according to a commercial service provider working with the BSI, being named on the leak site is followed by actual data publication in 92 percent of cases, on average 11 days after the listing. And the JavaScript used for the fake check could be traced across several hundred websites in historical data – the stage is broad, not limited to individual sites. On target selection, the BSI notes that an analysis of the leak site shows no significant focus on Germany as a region, but a strong focus on the education and healthcare sectors; public administration ranks in the top five.

What to do now

Because there is no vulnerability, every effective measure is a configuration or organisational decision that has to be made in advance.

  • Have Windows Terminal warn when multi-line text is pasted. Microsoft recommends this setting explicitly. It can be rolled out centrally and hits precisely the step the campaign depends on.
  • Restrict PowerShell for standard users. Microsoft names AppLocker, Application Control for Windows or Group Policy, and recommends running PowerShell in Constrained Language Mode; the BSI takes up the same list of measures in its warning. Line-of-business applications almost never need scripting freedom under standard accounts.
  • Restrict the Run dialog where it is not needed for daily work – that covers the older ClickFix variant as well. Microsoft additionally recommends watching for unusual clipboard activity immediately followed by a shell launch.
  • Enable PowerShell Script Block Logging and ship the logs off the machine. Without that record, later investigation is barely possible, precisely because commands issued through the tunnel may not be logged.
  • Treat an affected machine as network access, not as an isolated case. This is the central instruction in both sources. Credentials reachable from that machine belong in a rotation – where the host is domain-joined, that includes administrative accounts.
  • One single awareness message, but understood: no legitimate service will ever have you paste a command into Windows Terminal, PowerShell or the Run dialog. Anyone who did it anyway reports it – without consequences. The fake success message exists precisely so that nobody asks.

If you find indications of a compromise, the BSI asks to be contacted immediately through the established channels.

How sector7 supports you

We work through with you which of the settings above already apply in your environment and which can be added without friction in day-to-day operations – from the terminal warning through the PowerShell policy to the logging that makes the difference in an emergency. Under our Managed Services we operate and monitor the agreed environments through our NOC; endpoint protection, the analysis of security events and the awareness training without which the best terminal hardening is bypassed are part of our cyber security services. Where a suspicion arises, we help contain it instead of treating the affected machine in isolation.

Sources

Let's talk about your situation.

Arrange a call+49 212 240915 0