TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse
Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to make users run PowerShell payloads with reverse-tunnel implants.
Microsoft disclosed TerminalFix campaigns that direct users to run commands in Windows Terminal or PowerShell instead of the Run dialog, increasing the chance multi-line scripts execute. Compromised websites serve fake Cloudflare CAPTCHA verifications; the resulting PowerShell command downloads a ZIP with legitimate LockScreenContentServer.exe and rogue dui70.dll for DLL sideloading, retrieves payloads hidden in PNG images from attacker domains, persists via Registry Run keys and scheduled tasks, and performs domain trust and Active Directory reconnaissance. A Python-based reverse-tunnel implant (client.py) tunnels arbitrary TCP traffic over an encrypted WebSocket to gitnow[.]dev:443, giving attackers network-level proxy access that could enable privilege escalation, security-tool tampering, data theft or ransomware. Microsoft recommends AppLocker restrictions, PowerShell script block logging and ClickFix awareness training.
- Fake Cloudflare CAPTCHA prompts trick users into executing malicious PowerShell in Windows Terminal
- Attack uses DLL sideloading (dui70.dll) and PNG steganography to fetch hidden payloads
- Python backdoor client.py tunnels arbitrary TCP over WebSocket to gitnow[.]dev:443
- Implant persists via Registry Run keys and scheduled tasks and performs AD reconnaissance
- Microsoft advises AppLocker limits, PowerShell logging and ClickFix awareness training
Full article497 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 30, 2026Social Engineering / Malware
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell.
"While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully," Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan said in an analysis published this week.
The campaign, targeting organizations across multiple sectors, leverages compromised websites as a starting point to serve fake Cloudflare CAPTCHA verifications that prompt unsuspecting site visitors to copy and execute a malicious PowerShell command.
The attack chain, per the Windows maker, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant that grants the attacker persistent, network-level proxy access through the infected machine.
Specifically, the PowerShell command is designed to download a ZIP archive containing a legitimate binary ("LockScreenContentServer.exe") and a rogue DLL ("dui70.dll") in order to initiate a DLL sideloading attack.
The sideloaded DLL is responsible for retrieving next-stage payloads hidden within PNG images from external domains ("bestsocialmedianewspapper[.]com" or "offlineupdater[.]com"), establishes persistence via both Registry Run keys and scheduled tasks, carries out domain reconnaissance, and then deploys a Python-based reverse-tunnel command-and-control (C2) implant.
The backdoor ("client.py") is equipped to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure ("gitnow[.]dev:443") through an encrypted WebSocket channel, as well as enable the C2 server to reach any host visible from the victim's network.
The reconnaissance phase involves the following steps -
- Collect system metadata
- Perform domain trust discovery, domain admin enumeration, and Active Directory user and computer searches
- Ping named servers to map the internal network topology
The attack also delivers a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file.
"This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel," Microsoft said. "The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host."
The tech giant has warned that such access can be abused further to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware, making TerminalFix a serious threat to enterprise environments.
To mitigate the threat, it's advised to restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy; consider blocking or auditing the Windows Run dialog ("Win+R") if it's not required; monitor for DLL sideloading indicators; train employees to keep an eye out for ClickFix attacks; and enable PowerShell script block logging to detect and analyze obfuscated or encoded commands.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html