Active Directory reconnaissance

Attackers move the ClickFix paste into Windows Terminal to land a multi-stage intrusion chain

Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.