ClickFix Variant Uses Windows Terminal to Evade Detection

Summary

Microsoft says a ClickFix variant observed in February directs victims to run malicious PowerShell commands in Windows Terminal, leading to Lumma Stealer. Other variants use batch scripts, browser-process injection, or cloned AI tool sites.

Key points

The campaign uses fake CAPTCHA pages, troubleshooting prompts, and verification lures to persuade victims to execute malicious commands.
Instead of the Run dialog, victims are directed to open Windows Terminal with the Windows + X → I shortcut.
Microsoft says the change bypasses protections against Run dialog abuse; the approach was observed in the wild in February.
One attack chain uses PowerShell to decode embedded hexadecimal commands and deliver Lumma Stealer, with scheduled-task persistence and browser-data theft.
Another variant uses a batch script, MSBuild.exe, and QueueUserAPC()-based code injection into Chrome and Edge processes.
InstallFix uses cloned AI tool websites to trick victims into running commands that lead to information-stealer infections.

Article Details

Event Type: ClickFix attack variant that directs victims to use Windows Terminal to execute malicious commands.
Impact: The commands can bypass protections against Run dialog abuse and lead to Lumma Stealer infection. Reported effects include scheduled-task persistence, anti-malware evasion, and theft and exfiltration of browser data and other sensitive information. Another variant uses a batch script and process injection to harvest browser data and login data.

MITRE ATT&CK

T1053.005 · Scheduled TaskThe code establishes persistence using scheduled tasks.T1055 · Process InjectionAnother variant uses QueueUserAPC()-based code injection into chrome.exe and msedge.exe processes.T1059.001 · PowerShellThe Windows Terminal command spawns PowerShell, which decodes and executes embedded commands.T1059.003 · Windows Command ShellIn another variant, a batch script is executed through Command Prompt.T1140 · Deobfuscate/Decode Files or InformationPowerShell decodes embedded hex commands.T1204.004 · Malicious Copy and PasteVictims are tricked by fake CAPTCHA pages, troubleshooting prompts, or verification lures into executing malicious commands.T1555.003 · Credentials from Web BrowsersThe attack targets browser Web Data and Login Data for theft.

Malware

Lumma StealerThe execution of the malicious command in Windows Terminal spawns a PowerShell process that decodes embedded hex commands, triggering a multi-stage attack chain that leads to a Lumma Stealer infection.

Products

chrome.exeIt also performs QueueUserAPC()-based code injection into chrome.exe and msedge.exe processes to harvest Web Data and Login Data,” Microsoft says.MSBuild.exeIn another variant of the attack, the malicious commands executed in Windows Terminal lead to a batch script executed via command prompt and through MSBuild.exe.msedge.exeIt also performs QueueUserAPC()-based code injection into chrome.exe and msedge.exe processes to harvest Web Data and Login Data,” Microsoft says.PowerShellLike traditional ClickFix attacks, the campaign relies on fake CAPTCHA pages, troubleshooting prompts, and verification lures to trick victims into executing malicious PowerShell commands.Windows TerminalA new variant of the ClickFix attack evades detection by instructing victims to use Windows Terminal instead of the Run dialog, Microsoft warns.