Microsoft Threat Intelligence has identified a sophisticated new threat campaign dubbed ‘TerminalFix.’ This evolution of the ‘ClickFix’ social engineering technique targets organizations by leveraging compromised websites to display fake Cloudflare CAPTCHA verifications. Instead of directing users to the Windows Run dialog, TerminalFix tricks victims into pasting malicious PowerShell commands into Windows Terminal or PowerShell, enabling the execution of complex, multi-stage scripts.
How the Attack Works
The attack follows a highly methodical sequence designed to gain deep persistence and network access:
- Initial Access: Victims are tricked by a convincing fake Cloudflare Turnstile overlay into copying a malicious command to their clipboard and executing it in their terminal.
- DLL Sideloading: The script downloads a ZIP archive containing a legitimate, signed Windows binary (LockScreenContentServer.exe) and a malicious DLL (dui70.dll). The binary is used to sideload the malicious code, effectively bypassing security controls by leveraging a trusted process.
- Steganographic Extraction: The malware downloads PNG images containing hidden payload fragments within pixel data, which are then reassembled into active executables on the disk.
- Persistence & Recon: The threat actor establishes persistence through Registry Run keys and scheduled tasks, followed by aggressive internal reconnaissance, including domain trust enumeration, admin discovery, and server ping sweeps.
- Reverse Tunneling: The final stage involves the deployment of a Python-based implant that establishes a reverse WebSocket tunnel, granting attackers SOCKS-style network-level access to the internal environment.
Why This Is Critical
TerminalFix is particularly dangerous because it transforms a compromised endpoint into a pivot point for broader network exploitation. Attackers use this access to conduct reconnaissance, disable security controls, and prepare for potential ransomware deployment or data exfiltration.
Mitigation Guidance
Microsoft recommends the following steps to harden your environment against this threat:
- Restrict PowerShell: Utilize AppLocker or Application Control to limit PowerShell execution to authorized users.
- Monitor DLL Sideloading: Alert on any instances where ‘LockScreenContentServer.exe’ executes from non-standard directories.
- User Education: Train employees to identify fake CAPTCHA prompts and discourage pasting untrusted commands into terminal interfaces.
- Endpoint Protection: Enable network protection, cloud-delivered antivirus, and PowerShell script block logging to gain visibility into obfuscated command execution.
For security teams, Microsoft has provided detailed indicators of compromise (IOCs) and advanced hunting queries within the Defender XDR platform to help identify and neutralize this threat within your network.
