TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal.
Fake Cloudflare CAPTCHA and the Windows Terminal lure
Microsoft observed a ClickFix variant, dubbed TerminalFix, that starts with a fake Cloudflare CAPTCHA prompt designed to get victims to run a PowerShell command. The prompt instructs users to execute a command that is preloaded into the clipboard as part of the purported verification process, and the lure specifically directs victims into Windows Terminal or PowerShell. Microsoft notes that directing targets to Windows Terminal or PowerShell enables successful execution of more complex, multi-line scripts compared with typical ClickFix attacks.
First-stage delivery: signed executable and in-memory DLL loading
The initial PowerShell command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL. According to Microsoft, the signed executable is used to load the DLL, which decodes and launches an obfuscated payload directly in memory. The malware establishes persistence through both a scheduled task and a Registry Run key configured to execute every hour.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSteganography in PNGs for the second stage
For the second stage, the threat actor employed steganography: three PNG images were used to hide executables and DLL fragments in pixel data. The attack script downloads those image files from the command-and-control (C2) server and reassembles the embedded payloads on disk to continue the intrusion chain.
Custom Python reverse-tunnel to gitnow[.]dev:443 and network pivoting
The campaign’s most consequential capability is a custom Python reverse-tunnel module that connects outbound to gitnow[.]dev:443 over an encrypted WebSocket. Microsoft says the tunnel supports SOCKS5-style arbitrary TCP proxying, allowing the attacker to instruct the compromised host to reach internal IPs, hostnames, and ports accessible from the victim. The reverse-tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown.
Microsoft observed the attacks in the wild but did not observe hands‑on activity. The researchers warn, however, that access gained this way could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or deploying ransomware. In effect, this reverse-tunnel can turn an infected endpoint into a network pivot that provides an operator with a route to systems discovered during earlier Active Directory and network reconnaissance.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Microsoft recommends restricting and logging PowerShell execution, monitoring for LockScreenContentServer.exe running outside its normal path, and hardening browsers and endpoint protections. If compromise is confirmed, investigators should look for lateral movement and rotate credentials, including domain admin credentials if those credentials are accessible from the infected host.
- Affected enterprises and procurement leaders: The Blue Report 2026 warns that “overall prevention scores can hide what happens after initial access,” and that “once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments—underscoring the gap between blocking initial exploits and stopping abuse of legitimate credentials.
- End users and general public: The campaign specifically abuses a CAPTCHA verification premise to persuade targets to run PowerShell in Windows Terminal. Users should treat prompts that require running terminal commands as suspicious and escalate to IT or security teams rather than following instructions that run downloaded scripts.
TerminalFix shifts the ClickFix playbook from simple infostealers to a multi-stage intrusion that culminates in an outbound, proxy-capable reverse tunnel. The combination of in-memory loading, steganographic second stages, scheduled persistence, AD and network reconnaissance, and a SOCKS5-style reverse proxy makes an infected endpoint a potential springboard into internal networks. Organizations should prioritize detection of coerced PowerShell execution paths and the anomalous use of utilities such as LockScreenContentServer.exe, and treat any confirmed foothold as a possible pivot point that warrants credential rotation and a hunt for lateral movement.
