TerminalFix ClickFix Attack Campaign Hits Germany
A TerminalFix ClickFix attack campaign has compromised a German state institution’s network, Germany’s Federal Office for Information Security (BSI) confirmed on September 4. TerminalFix is an evolution of the ClickFix social-engineering technique: a fake CAPTCHA tricks a user into pasting a command, but instead of the old single-machine Run-dialog trick, it opens Windows Terminal and deploys a reverse tunnel that gives attackers a foothold across the entire network.
What Happened
Microsoft disclosed the TerminalFix campaign in a security blog post on August 28, 2026. Compromised websites display a fake Cloudflare CAPTCHA verification overlay that instructs the visitor to copy a command and paste it — not into the Windows Run dialog, as classic ClickFix attacks do, but into Windows Terminal or PowerShell. That distinction matters: Terminal and PowerShell reliably execute longer, multi-line scripts, where the Run dialog often fails or truncates. Microsoft described a multi-stage chain in which the pasted command triggers a hidden PowerShell script that downloads a ZIP archive from attacker infrastructure, extracts it to C:\ProgramData, and launches a loader tracked as AxolotLoader (also known as LoremIpsumLoader). The BSI advisory separately reported that the attackers installed a Python runtime and used a Python component to establish a TLS/WebSocket reverse tunnel over port 443, giving the attacker proxy-like access into the victim’s internal network from the single compromised host and supporting lateral movement — not unrestricted access to the entire network outright.
BSI’s own BSI-IT-Sicherheitsmitteilung, published September 4, 2026 at Kritikalität 2 (Hoch), states that BSI was notified in August of a German state institution’s network being compromised in a manner matching the TerminalFix pattern, and that the attackers attempted to install ransomware and exfiltrate data for double extortion. Separately, German outlet heise.de reports that TerminalFix was the confirmed initial access vector into the Berlin Senate’s network — the breach DIESEC covered on August 31, where the Rhysida ransomware group claimed roughly 5.79TB of data and Berlin’s mayor and interior senator publicly refused to pay. heise reports that the TerminalFix malware is linked to the same financially motivated cluster behind the Rhysida leak site, tracked as Vice Spider; BSI’s advisory confirms the state-institution compromise and the attempted ransomware/double-extortion activity, but does not itself name the Berlin Senate or the Vice Spider cluster — that attribution comes from heise’s reporting, not from BSI directly.
Why It Matters
This TerminalFix ClickFix attack campaign is the direct descendant of the original ClickFix technique DIESEC first covered in January 2026, but it closes the gap that made ClickFix a relatively contained problem: instead of compromising one machine, a successful TerminalFix lure hands the attacker a pivot point into the whole network within minutes: no traditional attachment or exploit was required to initiate the chain, since the user’s own copy-paste action triggered the download and execution of the malicious components that follow. That makes it functionally invisible to controls built around blocking malicious downloads or attachments — the user is the delivery mechanism, and by the time EDR sees anything unusual, the attacker may already be inside. For any organization with public-facing infrastructure or an internet-browsing workforce — which in practice is nearly every German Mittelstand company — this is a board-level awareness gap as much as a technical one, and the confirmed Berlin Senate connection shows it works against government-grade IT environments, not just soft targets.
What You Should Do Now
- Deploy Attack Surface Reduction (ASR) rules or equivalent endpoint controls that block PowerShell and Windows Terminal from being launched via clipboard-paste patterns triggered from a browser context, where your environment supports it — treat this as one useful control among several, not a universal default available in every EDR stack.
- Enable PowerShell Script Block Logging and consider Constrained Language Mode where appropriate, and monitor specifically for browser-to-PowerShell and browser-to-Windows-Terminal process chains — these are the BSI-supported detection points for this campaign.
- Verify: search endpoint and proxy logs for unexpected long-lived outbound WebSocket/TLS sessions from workstations (not servers), consistent with the reverse tunnel BSI describes, and for the AxolotLoader/LoremIpsumLoader indicators of compromise published in Microsoft’s advisory.
- Mitigate now, even without a confirmed incident: brief staff specifically on the CAPTCHA-then-paste-a-command pattern — standard phishing training rarely covers this, since no attachment or link is clicked in the traditional sense.
- Monitor and treat any affected host as a potential network entry point, not just an infected endpoint — this means a lateral-movement and credential-exposure review, not a malware removal and reimage alone.
If your organization has not briefed staff on ClickFix-style CAPTCHA lures since the original wave in January, treat that gap as current — TerminalFix shows the technique is still evolving and still working.
DIESEC Perspective
We flagged ClickFix as a technique to watch back in January. What’s changed since is not the lure — it’s the payload behind it. TerminalFix shows the same social-engineering trick can now deliver a pivot point into the network rather than just a single infected machine, and the fact that BSI confirms a German state institution was compromised via this technique — while heise separately ties the malware to the same actor cluster behind Berlin’s Rhysida breach — means this is not a theoretical risk for German public-sector and Mittelstand targets alike.
Not sure whether your staff would recognize a TerminalFix-style CAPTCHA lure, or whether your endpoint controls would catch the reverse tunnel that follows? Contact DIESEC for a rapid social-engineering exposure review and endpoint detection assessment.
Sources: Microsoft Security Blog | BSI | heise online
Published: 2026-09-08 | Category: Compliance & Governance | ~5 min read
