ClickFix Evolves: Scammers Now Abuse Windows Terminal to Deploy Stealers

Microsoft security researchers have issued a detailed warning about a significant evolution in the long-running 'ClickFix' social engineering campaign. This threat, which has historically relied on deceiving users through the Windows Run dialog, has now adopted a more sophisticated and stealthy approach by weaponizing the Windows Terminal application. The shift marks a concerning trend where attackers are increasingly abusing legitimate, trusted system tools to lend credibility to their malicious operations and bypass user defenses.

The core social engineering lure remains consistent. Attackers typically initiate contact through platforms like Microsoft Teams, Slack, or email, posing as technical support, IT staff, or a colleague. They claim the user's system has a critical issue—often a fake 'ClickFix' error—that requires immediate attention. Previously, the instructions guided the victim to open the Run dialog (Win+R) and paste a malicious command. The new tactic instructs the user to open Windows Terminal, a modern, multi-tabbed command-line application that is a default component in current Windows versions and is perceived by many as a legitimate administrative tool.

Once the user opens Windows Terminal, they are directed to paste and execute a specific PowerShell command. This command is the critical payload delivery mechanism. It is designed to download and execute a secondary script or a malicious executable from a remote attacker-controlled server. The ultimate payload in these recent campaigns has frequently been Lumma Stealer (also known as LummaC2), a potent information-stealing malware sold as Malware-as-a-Service (MaaS) in underground forums.

Lumma Stealer is a significant threat in its own right. It is capable of harvesting a vast array of sensitive data from an infected machine. This includes credentials stored in web browsers (passwords, autofill data), cookies and session tokens, cryptocurrency wallet information and seeds, files from specific directories, and data from messaging applications like Telegram and Discord. The stolen information is then exfiltrated to a command-and-control (C2) server, where it can be used for further attacks, sold on the dark web, or leveraged for direct financial theft, particularly from cryptocurrency accounts.

The strategic move from the Run dialog to Windows Terminal is not merely cosmetic. It represents a calculated effort to enhance the social engineering attack's success rate. Windows Terminal is a signed Microsoft application, and its use does not trigger the same immediate red flags as being told to download an unknown .exe file. For less technical users, being guided to use a program named 'Terminal' that is already on their computer can feel like a legitimate troubleshooting step. This abuse of trust in native tools is a growing challenge for defenders.

Implications for the Cybersecurity Community
This evolution has several key implications for security professionals and organizations:

1. Erosion of Trust in Native Tools: The abuse of tools like Windows Terminal, PowerShell, and others blurs the line between legitimate administration and malicious activity. Security monitoring solutions must now scrutinize the context and intent behind the use of these tools, not just their execution.
2. Enhanced Social Engineering Efficacy: By incorporating a legitimate system application into the attack chain, threat actors lower the victim's guard. Security awareness training programs must be updated to teach users that malicious instructions can come through any trusted interface.
3. Detection Challenges: Malicious commands run inside Windows Terminal may be harder to distinguish from legitimate administrator activity at the endpoint level. This necessitates more advanced behavioral analytics that look for anomalous sequences of commands, unusual network connections following terminal use, or the execution of known malicious scripts/payloads.
4. The MaaS Factor: The use of commodity stealers like Lumma lowers the barrier to entry for attackers, allowing less sophisticated groups to deploy high-impact malware. Defenders must assume these evolving social engineering tactics will be rapidly adopted by a broad range of threat actors.

Recommendations for Defense
To mitigate the risk posed by this evolved ClickFix campaign and similar threats, organizations should consider a multi-layered approach:

• Update User Training: Immediately incorporate specific examples of this attack vector into security awareness materials. Emphasize that no legitimate support personnel will ever ask a user to run arbitrary commands in Terminal, PowerShell, or the Run dialog.
• Implement Application Control: Where feasible, use application allowlisting or policies to restrict the execution of PowerShell and scripting engines to authorized users and systems only.
• Enhance Endpoint Monitoring: Deploy EDR/XDR solutions capable of correlating process lineage. An alert should be generated if Windows Terminal spawns processes that download content from the internet or exhibit stealer-like behaviors (e.g., accessing browser data files).
• Network Segmentation and Filtering: Use web gateways and firewalls to block connections to known malicious IPs and domains. Since the initial payload is downloaded, blocking the initial command's target URL can break the attack chain.
• Principle of Least Privilege: Ensure standard user accounts do not have administrative privileges, which can limit the damage of a successful infection.

The evolution of the ClickFix campaign from the Run dialog to Windows Terminal is a clear signal that threat actors are continuously refining their social engineering playbooks. By exploiting the inherent trust users place in their operating system's own tools, they achieve a higher level of deception. For the cybersecurity community, this underscores the perpetual need to adapt defensive strategies, moving beyond static indicators of compromise and towards a deeper understanding of malicious behavior and intent, regardless of the application wrapper it arrives in.