ClickFix and TerminalFix Explained: The Fake-CAPTCHA Attack That Breached Berlin

The Nisura Team · 8 September 2026

The most effective way into a network in 2026 isn’t a zero-day. It’s a web page that asks you to prove you’re human — and then talks you into pasting a command that installs the malware yourself. That technique is called ClickFix, and an advanced variant of it, TerminalFix, was the way into the August 2026 attack on Berlin’s state administration. There was no exotic exploit and no malicious attachment. This is a plain-English explanation of how the attack works, why your security tools struggle to see it, and how to stop it.

What ClickFix is

ClickFix is a social-engineering technique, first seen in October 2023, that turns the victim into the delivery mechanism. A web page — often a legitimate site that has been compromised — displays a convincing obstacle: a fake CAPTCHA, a “verify you are human” checkbox, or an error message claiming a document or video won’t load. To “fix” it, the page tells you to follow three simple steps. Those steps quietly copy a command onto your clipboard and instruct you to paste it into a Windows dialog and press Enter.

The moment you do, the command runs — typically launching PowerShell to download and execute malware. The genius, and the danger, is what’s absent:

• No software vulnerability. Nothing is being exploited — you are voluntarily running a program. There’s no CVE to patch.
• No malicious attachment or download prompt. The email gateway and the browser’s download scanner never see a file to block, because the payload is fetched by a command you typed.
• It weaponises a habit. Years of clicking “I’m not a robot” have trained us to complete verification steps without thinking. ClickFix borrows that reflex — and the authority of a Cloudflare or Google logo — to get consent.

Researchers have documented ClickFix growing into a self-sustaining ecosystem: credentials stolen by infostealers are used to log into legitimate websites and plant new ClickFix lures on them, which steal more credentials — a feedback loop. Variants now target macOS too, and Apple added a Terminal warning in 2026 specifically to blunt it.

TerminalFix: the escalation that hit Berlin

In August 2026, Microsoft Threat Intelligence published an analysis of TerminalFix, a ClickFix variant with two important upgrades. First, instead of the small Windows Run dialog (Win+R), TerminalFix directs victims to open Windows Terminal or PowerShell — which reliably runs the long, multi-line scripts that the Run box would mangle. Second, it doesn’t just drop a single info-stealer; it unfolds into a full, stealthy intrusion. Here is the chain Microsoft documented:

One honest caveat, straight from Microsoft’s write-up: in the specific chain it analysed, Microsoft did not observe the final ransomware deployment — the reverse tunnel provides the access from which an operator would then escalate privileges, steal data and deploy ransomware. Germany’s BSI attributed the initial access of the Berlin breach to TerminalFix, citing Microsoft’s analysis; the complete path the Rhysida group took to the data is still under forensic investigation. In other words, the entry technique is well documented; the full end-to-end story is the BSI’s assessment, not yet a closed case.

Why security tools struggle to see it

TerminalFix is a masterclass in abusing legitimacy at every step, which is why prevention that keys on “known-bad” struggles:

• The human is the exploit. No vulnerability is triggered, so patching and exploit-prevention have nothing to catch.
• It runs inside signed, trusted software. DLL sideloading means the malicious code executes under a legitimately signed Microsoft binary; the reverse tunnel runs under an unmodified, signed Python interpreter from python.org. Controls that trust “signed = safe” are blindsided.
• The payloads don’t look like payloads. Hiding executables inside PNG pixels defeats content inspection, and splitting a DLL across two images hides it further in transit.
• The command-and-control looks like the web. An encrypted WebSocket to a single host on port 443 is indistinguishable from an ordinary HTTPS session, running silently with no visible window.

This is the “living off the land, bring your own trust” playbook — and it’s the reason a CVE-only view of risk misses the threat entirely. There is no vulnerability on the scan; there’s a person, a habit, and a terminal.

The Berlin connection — and why it got worse

TerminalFix explains how the attackers got in to Berlin’s state network. What made the aftermath so severe was what they found once inside: the administration, by its own confirmation, kept plaintext password lists. TerminalFix hands an attacker a network pivot and Active Directory reconnaissance; plaintext credentials then turn that foothold into free movement across the environment. The result was a weeks-long outage and a ~1.44 million-file leak. For the full incident, see our analysis of the Berlin ransomware attack and our profile of the Rhysida group behind it.

How to defend against ClickFix and TerminalFix

Because the technique is part human, part technical, defence has to be both. Microsoft’s guidance, plus the fundamentals:

• Train the reflex out. The single highest-value control is awareness: teach every employee that pasting a command from a website into Terminal or Run is always an attack. This is precisely the security-awareness training NIS2 Article 21 expects.
• Restrict and log PowerShell. Enable script-block logging, enforce Constrained Language Mode where possible, and use execution policies (AllSigned/RemoteSigned). Block or audit the Run dialog (Win+R) where it isn’t needed, and configure Windows Terminal to warn when pasted text has multiple lines.
• Apply attack-surface-reduction rules and EDR. Block obfuscated scripts and scripts launching downloaded executables; turn on network/web protection; and alert on signed binaries such as LockScreenContentServer.exe running from non-standard paths.
• Assume credential exposure. Because the technique pivots into Active Directory, enforce phishing-resistant MFA everywhere, eliminate plaintext credential stores, and rotate credentials promptly after any suspected exposure.

Why this is the risk Nisura is built to quantify

ClickFix is the clearest example of the exposure a scanner can’t see. There is no CVE on your perimeter to find — the vector is a person and a pasted command. Nisura models this non-CVE credential-and-human path as a first-class contributor to your annual breach likelihood, prices the awareness training that most reduces it, and expresses the result as an Expected Annual Loss in euros — downtime, business interruption and EU regulatory liability included. Check your regulatory exposure with the NIS2 Scope Checker, or watch the live threat picture on the EU Ransomware Tracker.

The uncomfortable takeaway: none of this needed a nation-state or a novel exploit — just a fake checkbox and a moment of trust. Run the free CRQ simulation to see your own projected annual loss from exactly this kind of human-and-credential vector.

Sources & references

• Microsoft Threat Intelligence — “TerminalFix campaign deploys a reverse tunnel through multistage intrusion” (the primary technical analysis, with the full attack chain, MITRE ATT&CK mapping and IOCs) and the earlier “Think before you Click(Fix)” analysis of the technique.
• BSI — confirmation of the TerminalFix vector in the Berlin incident (official Mastodon channel).
• Wikipedia — ClickFix (background, timeline and the infostealer feedback loop), and reporting from Ars Technica and BleepingComputer.
• Hudson Rock — “From Victim to Vector: How Infostealers Turn Legitimate Businesses into Malware Hosts” (the ClickFix / infostealer feedback loop).

This article describes the technique for defensive awareness only; it deliberately does not reproduce any working lure, command or payload. Indicators such as file and domain names are published defensive IOCs from Microsoft’s report. Attribution of the Berlin incident’s initial vector is the BSI’s, citing Microsoft; the full intrusion path remains under investigation. Nisura did not scan, probe, or access any affected systems for this article.