A new variant of ClickFix, named TerminalFix, employs deceptive Cloudflare CAPTCHA prompts on compromised sites to deceive victims into running harmful PowerShell commands within Windows Terminal.
In contrast to standard ClickFix attacks that frequently result in infostealer malware infections, this operation utilizes a multi-stage intrusion process that ultimately provides attackers with a reverse tunnel into the victim’s internal network.
TerminalFix is distinct from typical ClickFix attacks as it directs users to Windows Terminal or PowerShell, facilitating the successful execution of more intricate, multi-line scripts.
Microsoft has identified these attacks in the wild but has not detected any hands-on activity. Nevertheless, researchers caution that access gained in this manner could be exploited for lateral movement, privilege escalation, credential theft, disabling security measures, data exfiltration, or deploying ransomware.
The infection process starts with a fraudulent CAPTCHA prompt that instructs victims to run a PowerShell command that has been preloaded into the clipboard as part of the supposed verification procedure.
This command downloads a ZIP file containing a legitimate signed executable along with a malicious DLL file, which decodes and executes an obfuscated payload directly in memory.
In the second stage, the threat actor employs steganography to conceal executables and DLL fragments within the pixel data of three PNG images. The script retrieves the image files from the command-and-control (C2) server and reconstructs the embedded payloads on the disk.
The malware ensures persistence through a scheduled task and a Registry Run key, set to execute every hour.
While active, it conducts reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; gathering system information; and enumerating Active Directory (AD).
The key component is a custom Python reverse-tunnel module that connects to an outbound address (gitnow[.]dev:443) via an encrypted WebSocket, enabling SOCKS5-style arbitrary TCP proxying.
This functionality allows the attacker to command the compromised machine to connect to internal IPs, hostnames, and ports accessible from the victim.
The reverse-tunnel also supports multiplexing multiple connections over a single WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown capabilities.
According to Microsoft, this can transform the infected endpoint into a network pivot, providing the operator with a pathway to systems identified during the earlier AD and network reconnaissance phase.
The researchers advise restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its usual path, and strengthening browser and endpoint protections.
If a compromise is confirmed, it is recommended to investigate for lateral movement and to rotate credentials, including domain admin credentials, if they are accessible from the infected host.
Once attackers obtain valid credentials, only 37% of their actions are blocked.
Overall prevention metrics can obscure what occurs after initial access. Once attackers are utilizing valid credentials, prevention effectiveness declines significantly.
The Blue Report 2026 evaluates defense techniques on a case-by-case basis across 338 million simulations conducted in customer production environments.
Get the report
Source: Original article
