TerminalFix: Fake Cloudflare CAPTCHAs Open the Door to Corporate Networks

Microsoft has documented a new variant of the ClickFix family of social-engineering attacks, dubbed TerminalFix. Classic ClickFix campaigns steer the victim to the “Run” dialog box (Win+R), whereas TerminalFix invites them to paste a command into Windows Terminal or PowerShell. According to the researchers, this improves the odds of successfully executing complex, multi-line scripts.

How the lure works

The starting point is compromised websites, where visitors are shown a fake CAPTCHA check supposedly from Cloudflare. Under the pretext of “confirming they're human,” users are asked to copy and run a PowerShell command. This command downloads a ZIP archive containing a legitimate executable (LockScreenContentServer.exe) and a rogue library (dui70.dll) — kicking off an attack via DLL substitution (DLL sideloading).

A multi-stage chain

The loaded library extracts the next components, hidden inside PNG images using steganography, which are downloaded from external domains. The malware then establishes persistence in two ways at once — through registry autorun keys and scheduled tasks — performs domain reconnaissance, and deploys a Python-based reverse-tunnel implant.

The backdoor (client.py) tunnels arbitrary TCP traffic to the attackers' infrastructure over an encrypted WebSocket channel, and also lets the command server reach any host visible from the victim's network. Separately, a PowerShell loop remains on the system, watching a text file, executing any commands that appear in it via Invoke-Expression, and writing the results to an output file.

At the reconnaissance stage, the malware gathers system metadata, searches for domain trust relationships, enumerates domain administrators and Active Directory objects, and maps the internal network by pinging servers.

Why it's dangerous and how to defend

The danger, Microsoft stresses, is that the reverse tunnel gives the attacker direct network access inside the organization: from a compromised host they can locate and reach other systems, escalate privileges, disable defenses, steal data, and deploy ransomware.

As protective measures, Microsoft recommends restricting the launch of PowerShell and the “Run” dialog for regular users via AppLocker, Application Control, or group policies; blocking or auditing Win+R where it isn't needed; watching for signs of DLL sideloading; enabling PowerShell script block logging; and training employees to recognize ClickFix-style attacks.

Source: The Hacker News