TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse
Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to make users run PowerShell payloads with reverse-tunnel implants.
Microsoft disclosed TerminalFix campaigns that direct users to run commands in Windows Terminal or PowerShell instead of the Run dialog, increasing the chance multi-line scripts execute. Compromised websites serve fake Cloudflare CAPTCHA verifications; the resulting PowerShell command downloads a ZIP with legitimate LockScreenContentServer.exe and rogue dui70.dll for DLL sideloading, retrieves payloads hidden in PNG images from attacker domains, persists via Registry Run keys and scheduled tasks, and performs domain trust and Active Directory reconnaissance. A Python-based reverse-tunnel implant (client.py) tunnels arbitrary TCP traffic over an encrypted WebSocket to gitnow[.]dev:443, giving attackers network-level proxy access that could enable privilege escalation, security-tool tampering, data theft or ransomware. Microsoft recommends AppLocker restrictions, PowerShell script block logging and ClickFix awareness training.
- Fake Cloudflare CAPTCHA prompts trick users into executing malicious PowerShell in Windows Terminal
- Attack uses DLL sideloading (dui70.dll) and PNG steganography to fetch hidden payloads
- Python backdoor client.py tunnels arbitrary TCP over WebSocket to gitnow[.]dev:443
- Implant persists via Registry Run keys and scheduled tasks and performs AD reconnaissance
- Microsoft advises AppLocker limits, PowerShell logging and ClickFix awareness training
- ATT&CK
- T1189 Drive-by CompromiseT1059.001 PowerShellT1574.002 Hijack Execution Flow: DLL Side-LoadingT1547.001 Registry Run Keys / Startup FolderT1482 Domain Trust Discovery
- Tags
- clickfixdll-sideloadingfake-captchamicrosoftpowershellreverse-tunnelsocial-engineeringterminalfix
- Vendors
- MicrosoftCloudflare
- Malware
- TerminalFix
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 30, 2026 Social Engineering / Malware Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix , that aims to trick users into running a malicious command in Windows Terminal or PowerShell.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.