Windows Terminal Exploited in ClickFix Campaign for Lumma Stealer

Microsoft recently disclosed a sophisticated campaign involving the ClickFix social engineering TTP. This specific wave, detected in February 2026, diverges from previous iterations by instructing victims to use the Windows Terminal application rather than the traditional Windows Run dialog box. The primary objective is the deployment of Lumma Stealer, a potent information-stealing malware designed to exfiltrate browser credentials, cryptocurrency wallets, and sensitive files. This shift represents a tactical adjustment by threat actors to circumvent existing security controls that focus on more traditional command execution methods.

Technical Analysis of the ClickFix Windows Terminal Attack Vector

According to The Hacker News, attackers use compromised or malicious websites to display fake error messages. These overlays often mimic legitimate browser warnings or document viewer errors, claiming a technical issue prevents the content from loading. The victim is then presented with a “Fix It” button, which initiates a deceptive workflow.

Unlike older Phishing campaigns that relied on the Win + R shortcut to execute PowerShell commands, this variant leverages the modern Windows Terminal emulator. This shift is likely an attempt to bypass security detections that monitor the “Run” dialog for suspicious command-line activity. By using the terminal emulator, threat actors exploit the user’s perception of the application as a legitimate administrative tool. Once the victim follows the instructions—typically involving copying a malicious script to the clipboard and pasting it into the terminal—the attack chain begins. This script generally downloads and executes the Lumma Stealer payload directly into memory or as a temporary file.

How to Detect ClickFix Windows Terminal Exploit Activity

Security teams must understand how to detect ClickFix Windows Terminal exploit patterns within their environment. The execution of high-privilege scripts via terminal sessions initiated by browser-spawned processes is a major IoC. SOC analysts should monitor for unusual parent-child process relationships. For instance, a web browser (e.g., chrome.exe or msedge.exe) followed by the manual opening of wt.exe (Windows Terminal) by the user is a red flag when followed immediately by network connections to known malicious domains.

Lumma Stealer Malware Detection Strategies

Lumma Stealer is known for its aggressive C2 communication protocols and its ability to harvest data from Chromium-based browsers. Effective Lumma Stealer malware detection strategies include:

• Monitoring PowerShell logs (Event ID 4104) for obfuscated scripts containing Invoke-WebRequest or IEX commands that originate from terminal sessions.
• Utilizing EDR solutions to flag terminal commands that attempt to reach out to external IP addresses immediately after the terminal process is initialized.
• Mapping observed behaviors to the MITRE ATT&CK framework, specifically focusing on T1204.002 (User Execution: Malicious File) and T1059.001 (PowerShell).

Mitigation and Defense Recommendations

Defenders should focus on behavioral monitoring and reducing the attack surface rather than relying solely on static signatures. Because the attack relies on user interaction, technical controls must be paired with user awareness training.

How to Mitigate ClickFix Social Engineering Attacks

Organizations can mitigate ClickFix social engineering attacks by implementing strict execution policies. Restricted PowerShell execution policies can prevent basic scripts from running, though sophisticated attackers may find bypasses. A more effective approach involves the principle of least privilege; ensuring users do not have administrative rights prevents many of the commands used in these campaigns from achieving their full impact.

Furthermore, blocking known malicious C2 infrastructure at the perimeter and using web filtering to categorize and block suspicious domains can disrupt the attack chain before the final payload is delivered. Security teams should also consider disabling the Windows Terminal application for users who do not require it for their primary job functions, thereby removing the specific tool used in this recent campaign.