Microsoft has disclosed a new ClickFix campaign named TerminalFix that uses fake Cloudflare CAPTCHA verification pages to persuade users into executing malicious commands through Windows Terminal or PowerShell. According to Microsoft’s security researchers, TerminalFix builds on existing ClickFix techniques but replaces the Windows Run dialog with Windows Terminal or PowerShell, increasing the likelihood that more complex and multi line scripts execute successfully. The campaign has been observed targeting organizations across multiple industries by compromising legitimate websites and displaying fraudulent CAPTCHA prompts that instruct visitors to copy and run a malicious PowerShell command. Microsoft detailed the findings in its security analysis available at here.
The PowerShell command used in the campaign downloads a ZIP archive containing a legitimate executable named LockScreenContentServer.exe together with a malicious DLL called dui70.dll, enabling a DLL sideloading attack. Once executed, the rogue DLL retrieves additional payloads concealed inside PNG image files hosted on external domains, establishes persistence through Registry Run keys and scheduled tasks, performs Active Directory reconnaissance, and ultimately deploys a Python based reverse tunnel implant. The malware, identified as client.py, creates an encrypted WebSocket connection to attacker controlled infrastructure at gitnow.dev over port 443, allowing arbitrary TCP traffic to pass through the compromised device. This capability enables attackers to communicate with systems that are accessible from the victim’s internal network, effectively creating a persistent network level proxy that can be used for additional malicious activity.
Microsoft explained that the malware carries out extensive reconnaissance after gaining access to a system. It collects system information, performs domain trust discovery, identifies domain administrator accounts, searches Active Directory users and computers, and pings named servers to map the internal network. The campaign also deploys a persistent PowerShell file monitoring loop that continuously watches a text file for new instructions, executes those commands using Invoke Expression, and records the results in an output file. According to Microsoft, the combination of reconnaissance capabilities and the reverse tunnel significantly increases the risk to enterprise environments because attackers can use the compromised host to identify additional systems, extend network access, escalate privileges, reduce the effectiveness of security controls, exfiltrate sensitive information, or deploy ransomware during later stages of an intrusion.
Microsoft has advised organizations to adopt several defensive measures to reduce exposure to TerminalFix attacks. Recommended protections include restricting PowerShell and Windows Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy. Organizations are also encouraged to consider blocking or auditing the Windows Run dialog when it is not required, monitor systems for indicators of DLL sideloading activity, provide employee awareness training focused on ClickFix style social engineering campaigns, and enable PowerShell script block logging to improve detection and analysis of obfuscated or encoded commands. Microsoft noted that these measures can help security teams identify suspicious activity earlier and reduce the likelihood of successful compromise through this latest ClickFix variant.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
