# TerminalFix Campaign Leverages PowerShell to Establish Enterprise Network Persistence
A new threat campaign dubbed TerminalFix weaponizes PowerShell scripts to deliver multistage attacks against enterprise networks, security researchers report. The operation mirrors tactics used by the ClickFix campaign, which historically employed social engineering to trick users into executing malicious code. TerminalFix extends this approach by establishing reverse tunnel connections that grant attackers ongoing network access.
The attack chain begins with social engineering delivery vectors. Threat actors distribute malicious PowerShell payloads through phishing emails, compromised websites, or support scams. When executed, these scripts run with the privileges of the user who launches them, often providing sufficient permissions to establish persistence mechanisms.
PowerShell remains an effective attack vector because it operates natively on Windows systems without requiring additional software installation. System administrators rarely block PowerShell execution entirely since legitimate administrative tasks depend on it. This creates a detection blind spot that attackers exploit. The TerminalFix scripts bypass common security controls by living off the land, utilizing tools already present on target machines.
The multistage design separates attack components across phases. Initial execution establishes a foothold. Secondary stages download additional tools or establish reverse tunnel connections. These reverse tunnels create encrypted channels from victim networks back to attacker infrastructure, bypassing perimeter firewalls and network monitoring systems. Once established, attackers maintain persistent access for reconnaissance, lateral movement, and data exfiltration.
The reverse tunnel component presents particular organizational risk. Rather than attackers pushing inbound connections through firewalls, the victim's system initiates outbound connections to attacker command servers. This traffic blends with legitimate enterprise network activity. Attackers then route all malicious activity through these established tunnels, avoiding direct connections that firewalls or intrusion detection systems might flag.
Organizations cannot distinguish TerminalFix activity from authorized administrative PowerShell use without behavioral analysis. Endpoint detection and response tools must establish baselines for normal PowerShell activity within their environments, then identify deviations. Reverse tunnel creation generates specific process chains and network patterns that security teams should monitor.
The ClickFix connection matters operationally. ClickFix campaigns traditionally targeted consumer victims through fake support sites and social engineering. The application of similar tactics to enterprise environments suggests threat actors are targeting organizations with limited security awareness training or insufficient email filtering.
Defense against TerminalFix requires multiple layers. Email security systems should block attachments and links that trigger PowerShell execution. User training must teach employees to recognize social engineering attempts. Network segmentation prevents lateral movement after initial compromise. Application whitelisting restricts script execution to approved versions. Logging all PowerShell activity, including script content, enables forensic investigation and threat hunting.
Organizations should review PowerShell execution logs for suspicious commands involving reverse shell utilities, proxy tools, or credential dumping functions. Legitimate administrative PowerShell use typically involves known scripts or remote management frameworks. Anomalies warrant investigation.
TerminalFix demonstrates how established attack methodologies continue evolving to target higher-value victims. Enterprises using legacy security controls that focus primarily on malware detection rather than behavioral analysis face elevated risk from this campaign.