'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks
TerminalFix campaign uses PowerShell and reverse tunnels for enterprise attacks.
The 'TerminalFix' campaign, similar to the ClickFix style, employs a sophisticated, multistage attack chain. It leverages PowerShell as a primary weapon and establishes reverse tunnels to gain persistent access into victim organizations' networks, indicating a focus on deep infiltration and control.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe TerminalFix campaign exploits a social-engineering lure — similar to ClickFix — that tricks users into executing malicious PowerShell commands, bypassing traditional perimeter defenses by abusing a trusted, built-in system tool. Once executed, the attack establishes reverse tunnels that allow attackers to maintain persistent, covert access deep within enterprise networks, making detection and eviction significantly harder. This matters because PowerShell abuse combined with reverse tunneling can circumvent firewalls and egress controls that would normally block inbound attacker connections. The multistage nature of the chain means that without proper logging and segmentation, defenders may not detect the compromise until significant damage has been done.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.