Microsoft Threat Intelligence revealed that the ClickFix social engineering campaign has evolved to use Windows Terminal as a primary vehicle for deploying the Lumma Stealer malware.

This update marks a tactical shift from previous methods that relied on the Windows Run dialog, aiming to bypass security detections specifically tuned for older execution shortcuts.

How the Attack Works

• Deceptive Lures: Users encounter fake “Human Verification” CAPTCHAs or browser error messages on compromised websites.
• The Workflow: The victim is coached to press Win + X and then I to open Windows Terminal. A malicious command is automatically copied to their clipboard, which they are then prompted to paste and run.
• Strategic Advantage: By using Windows Terminal, attackers leverage a trusted administrative environment that many users associate with legitimate troubleshooting, making the social engineering attempt more convincing.

Impact and Payloads

The campaign’s primary goal is the deployment of Lumma Stealer, a sophisticated data harvester.

• Targeted Data: The malware focuses on sensitive browser files, specifically “Web Data” and “Login Data,” to steal credentials and cryptocurrency wallet information.
• Evasion Tactics: It utilizes process injection into  and  and abuses “Living off the Land” binaries (LOLBins) like  to hide its activity from security software.
• Infrastructure: The campaign has been observed using “Etherhiding” techniques, connecting to blockchain RPC endpoints to retrieve malicious instructions.