[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEw4ixqCkF34qpygNe-7vdIvcLgbTWCkizKDvTzOcWvY":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"c93e31e8-90fd-4f0d-baa3-51e6e19a0e07","'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks","terminalfix-campaign-weaponizes-powershell-for-enterprise-attacks-8af725","The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations' networks.","The 'TerminalFix' campaign, similar to the ClickFix style, employs a sophisticated, multistage attack chain. It leverages PowerShell as a primary weapon and establishes reverse tunnels to gain persistent access into victim organizations' networks, indicating a focus on deep infiltration and control.","TerminalFix campaign uses PowerShell and reverse tunnels for enterprise attacks.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fterminalfix-campaign-weaponizes-powershell-enterprise-attacks","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt20cb8eccfb020b93\u002F6a95d0de3450f0664b0636bb\u002FPowerShell_icon-Think_About_Life-GettyImages-2153775274.jpg?width=720&quality=80&disable=upscale","2026-08-31T20:25:36+00:00","2026-08-31T22:00:20.558953+00:00",7,[17,20,22],{"name":18,"type":19},"TerminalFix","campaign",{"name":21,"type":19},"ClickFix",{"name":23,"type":24},"PowerShell","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":27,"name":28,"slug":29},null,"Threat Intelligence","threat-intelligence",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[],{"controls":49,"vendors":132},[50,76,105],{"slug":51,"name":52,"problem":53,"products":54},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":72,"product_name":73,"url":74,"description":75},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":121,"url":122,"description":123},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[133],{"slug":134,"name":135,"logo_path":136,"roles":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[138],"affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":156},"terminalfix-campaign-abuses-powershell-and-reverse-tunnels-for-deep-enterprise-infiltration","TerminalFix Campaign Abuses PowerShell and Reverse Tunnels for Deep Enterprise Infiltration","The TerminalFix campaign exploits a social-engineering lure — similar to ClickFix — that tricks users into executing malicious PowerShell commands, bypassing traditional perimeter defenses by abusing a trusted, built-in system tool. Once executed, the attack establishes reverse tunnels that allow attackers to maintain persistent, covert access deep within enterprise networks, making detection and eviction significantly harder. This matters because PowerShell abuse combined with reverse tunneling can circumvent firewalls and egress controls that would normally block inbound attacker connections. The multistage nature of the chain means that without proper logging and segmentation, defenders may not detect the compromise until significant damage has been done.",[144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1572: Protocol Tunneling","MITRE ATT&CK T1566: Phishing (User Execution)","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AT-1: Security Awareness Training",{}]