Microsoft has warned of TerminalFix attacks in which fake Cloudflare CAPTCHA checks trick Windows users into running malicious PowerShell commands, giving criminals a potential route into internal networks through a reverse tunnel.
The campaign is a more advanced form of the ClickFix technique, which uses bogus prompts to persuade people to paste or execute commands on their computers. Rather than delivering a conventional information-stealing program, the operation builds a multi-stage foothold that could allow attackers to move through a compromised organisation.
Microsoft said it had observed the attacks in the wild but had not seen evidence of the operators carrying out hands-on activity after gaining access. It warned, however, that the capability could be used for lateral movement, privilege escalation, credential theft, data theft, the disabling of security software or ransomware deployment.
The initial fake CAPTCHA tells the victim to complete a verification step by running a command that has been placed in the Windows clipboard. The command launches Windows Terminal or PowerShell, allowing the attackers to run a longer and more complex script than is typically used in ClickFix campaigns.
That script downloads a ZIP archive containing a legitimate, digitally signed executable alongside a malicious DLL. The DLL uses the trusted program to decode an obfuscated payload and launch it directly in memory, making detection more difficult.
The next stage conceals parts of executable and DLL files inside the pixel data of three PNG images. The script retrieves the images from the attackers’ command-and-control server and reconstructs the hidden components on the infected computer.
Persistence is then established using both a scheduled task and a Registry Run key, with the malware configured to execute hourly. It gathers details about the computer and searches the environment for domain controllers, databases, backup servers, network gateways, mail systems and other infrastructure, while also enumerating Active Directory.
TerminalFix creates a route into internal networks
At the centre of the operation is a custom Python reverse-tunnel component. It makes an outbound connection to gitnow[.]dev:443 through an encrypted WebSocket and provides SOCKS5-style proxying for arbitrary TCP traffic.
This means the attacker can direct the infected computer to connect to internal IP addresses, hostnames and ports that may not be accessible from the public internet. Microsoft said the endpoint can therefore act as a network pivot, offering a route to systems identified during reconnaissance.
The tunnel can carry multiple connections over a single WebSocket and includes features such as keepalive signals, remote shutdown and the rotation of realistic browser User-Agent strings. Those functions may help the connection remain active while blending in with normal web traffic.
Microsoft advised organisations to restrict and log PowerShell use, investigate instances of LockScreenContentServer.exe running outside its expected location, and strengthen browser and endpoint protections.
Where a TerminalFix compromise is suspected, defenders should examine the network for signs of lateral movement and reset exposed credentials. Microsoft specifically warned that domain administrator passwords should be rotated if they may have been accessible from the infected machine.
