"This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel," Microsoft said.
Fake Cloudflare CAPTCHAs and the PowerShell lure
Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan describe a new ClickFix variant, TerminalFix, that begins on compromised websites serving fake Cloudflare CAPTCHA prompts. The prompts instruct visitors to copy and execute a malicious PowerShell command inside Windows Terminal or PowerShell. According to the researchers, TerminalFix deliberately directs victims to Windows Terminal or PowerShell rather than the Windows Run dialog used in prior ClickFix campaigns, "increasing the likelihood that complex, multi-line scripts execute successfully."
DLL sideloading and steganographic payload extraction
The copied PowerShell command downloads a ZIP archive containing a legitimate binary, LockScreenContentServer.exe, alongside a malicious DLL named dui70.dll. The pair are used to perform DLL sideloading: the legitimate executable loads the rogue DLL, which the researchers say then retrieves further payloads hidden inside PNG images hosted on external domains — specifically bestsocialmedianewspapper[.]com and offlineupdater[.]com. Microsoft characterizes this stage as steganographic payload extraction and a key mechanism that moves the attack from simple code execution to a multi-component intrusion.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPython reverse-tunnel implant and gitnow[.]dev:443
Once the sideloaded DLL has planted next-stage components, the campaign deploys a Python-based reverse-tunnel implant named client.py. Microsoft reports that client.py establishes an encrypted WebSocket channel to attacker infrastructure at gitnow[.]dev:443 and is capable of tunneling arbitrary TCP traffic back to the C2 server. That connection not only allows outbound traffic from the infected host but also lets the C2 reach "any host visible from the victim's network," turning a single compromised machine into a persistent network-level proxy.
Reconnaissance, persistence, and a file-watch backdoor
Microsoft's write-up lays out a comprehensive reconnaissance routine executed from the compromised host: collecting system metadata; performing domain trust discovery and domain admin enumeration; searching Active Directory for users and computers; and pinging named servers to map internal topology. Persistence is established through Registry Run keys and scheduled tasks. The intrusion also drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file—effectively creating a secondary, script-driven control channel.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Monitor for indicators the researchers highlight — DLL sideloading patterns, unexpected scheduled tasks and Run keys, and outbound WebSocket connections to anomalous hosts such as gitnow[.]dev:443. Microsoft also recommends enabling PowerShell script block logging to help detect obfuscated or encoded commands.
- Affected enterprises and procurement leaders: The campaign underscores the risk of compromised third-party websites as initial access vectors. Microsoft advises restricting PowerShell and Run dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy, and considering blocking or auditing the Windows Run dialog (Win+R) where it is not required.
- End users and employee populations: Microsoft recommends training staff to recognize ClickFix-style lures — in this case, fake CAPTCHA prompts that ask users to paste and run commands — and to treat unsolicited copy-paste instructions into PowerShell or terminal windows as a high-risk indicator.
Microsoft warns that TerminalFix's combination of deep reconnaissance and a reverse-tunnel capability "could enable an attacker to identify and reach additional systems from a compromised host," and that such access may be abused to escalate privileges, disarm security controls, exfiltrate sensitive data, or deploy ransomware. The chain — social engineering via fake CAPTCHAs, PowerShell download, DLL sideloading, steganographic retrieval, and a Python reverse-tunnel — demonstrates a layered approach designed to convert a single browser visit into persistent, lateral access across an enterprise network.
The technical specifics Microsoft published — file names, domains, and the target of the WebSocket tunnel — give defenders concrete artifacts to hunt for and block. At the same time, the campaign is a reminder that even well-known user interactions, like passing CAPTCHA challenges or following an on-screen prompt, can be weaponized when combined with powerful scripting environments and sideloadable binaries.
Read Microsoft's analysis and the original reporting here: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html
