{"id":176,"date":"2026-03-06T09:01:08","date_gmt":"2026-03-06T09:01:08","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=176"},"modified":"2026-03-06T09:01:08","modified_gmt":"2026-03-06T09:01:08","slug":"microsoft-reveals-clickfix-campaign-using-windows-terminal-to-deploy-lumma-stealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=176","title":{"rendered":"Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Mar 06, 2026<\/span><\/span>Endpoint Security \/ Browser Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft on Thursday disclosed details of a new widespread ClickFix social engineering campaign that has leveraged the Windows Terminal app<\/a> as a way to activate a sophisticated attack chain and deploy the Lumma Stealer malware.<\/p>\n

The activity, observed in February 2026, makes use of the terminal emulator program instead of instructing users to launch the Windows Run dialog and paste a command into it.<\/p>\n

\u00abThis campaign instructs targets to use the Windows + X \u2192 I shortcut to launch Windows Terminal (wt.exe) directly, guiding users into a privileged command execution environment that blends into legitimate administrative workflows and appears more trustworthy to users,\u00bb the Microsoft Threat Intelligence team said<\/a> in a series of posts on X.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

What makes the latest variant notable is that it bypasses detections specifically designed to flag Run dialog abuse, not to mention take advantage of the legitimacy of Windows Terminal to trick unsuspecting users into running malicious commands delivered via bogus CAPTCHA pages, troubleshooting prompts, or other verification-style lures.<\/p>\n

The post-compromise attack chain is also unique: when the user pastes a hex-encoded, XOR-compressed command copied from the ClickFix lure page into a Windows Terminal session, it spans additional Terminal\/PowerShell instances to ultimately invoke a PowerShell process responsible for decoding the script.<\/p>\n

This, in turn, leads to the download of a ZIP payload and a legitimate but renamed 7-Zip binary, the latter of which is saved to disk with a randomized file name. The utility then proceeds to extract the contents of the ZIP file, triggering a multi-stage attack chain that involves the following steps –<\/p>\n