“After extraction, the source images are deleted to reduce forensic artifacts,” wrote Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan — a short sentence that highlights a long, deliberate campaign designed to hide in plain sight.
How TerminalFix repackages ClickFix to push victims into PowerShell
Microsoft describes a fresh variant of the ClickFix social-engineering trick, which it calls "TerminalFix." Unlike earlier ClickFix lures that steer victims into the Windows Run dialog, TerminalFix nudges users to paste commands into Windows Terminal or PowerShell. The campaign spoofs a Cloudflare CAPTCHA checkbox — complete with a Cloudflare logo — so that a fake verification command is copied to the clipboard and then pasted by the victim into a terminal window.
That single, pasted command runs a hidden PowerShell script that prints a decoy message, “Starting Cloudflare verification…,” then downloads a ZIP archive from an attacker-controlled server and extracts it under C:\ProgramData. The extracted archive launches a batch file named 1.bat, which silently runs LockScreenContentServer.exe.
DLL sideloading and PNG steganography: how the payload is built
LockScreenContentServer.exe is a legitimate, signed Windows executable that the attackers use as a DLL sideloading host. The sideloaded file, dui70.dll — presented as a “Windows DirectUI Engine” — is actually malicious and executes a second-stage PowerShell script once loaded. That second-stage script fetches additional payloads that are concealed inside PNG images, using steganography to evade simple file- and content-type inspection.
The attackers split the payload across three PNGs: the first image contains an executable, while the second and third each hold halves of a DLL that the script reassembles on disk. After reassembly the images are deleted, reducing forensic traces, the researchers note.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePersistence, reconnaissance, and a custom reverse tunnel to gitnow[.]dev
Once resident, the malware establishes redundant persistence via HKCU\…\Run registry keys and scheduled tasks that re-launch LockScreenContentServer.exe every 60 minutes. The implant then performs broad local and domain reconnaissance: collecting system information across English, Spanish, and German language configurations; discovering domain trusts and domain administrators; searching Active Directory users and computers; and pinging named servers associated with roles such as domain controllers, databases, backups, gateways, and mail systems.
The campaign also installs a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them with Invoke-Expression, and writes results back to an output file — effectively giving an operator remote command execution without a visible process. Finally, attackers deploy a custom Python-based reverse-tunnel implant launched via pythonw.exe with no visible window. That tunnel opens a reverse WebSocket connection to gitnow[.]dev:443 and provides SOCKS-style TCP proxy access through the compromised host, giving the intruder network-level proxying inside the victim environment.
What this means for security teams, employees, and procurement leaders
- Security teams: the chain combines social engineering, signed-binary sideloading, steganography, scheduled-task persistence, AD reconnaissance, in-band command plumbing (file-watch/Invoke-Expression) and a persistent reverse WebSocket tunnel. Monitoring for unexpected uses of signed system binaries, unusual scheduled tasks, and outbound WebSocket connections to suspicious hosts such as gitnow[.]dev:443 should be priorities.
- Employees and general users: the immediate risk is social engineering that asks you to paste multi-line commands into Terminal or PowerShell. The campaign’s lure looks like a Cloudflare CAPTCHA and instructs victims to paste a command copied to the clipboard — a typical ClickFix tactic repackaged for modern terminals.
- Procurement and IT controls: reliance on Run dialog or unconstrained PowerShell usage expands the attack surface. The technique exploits operational convenience (terminal pastes, signed binaries) to gain persistence and network access, underscoring the value of tightening execution policies and application control.
Microsoft’s mitigation advice and the unanswered operational picture
Microsoft recommends restricting PowerShell and Run dialog execution, and either blocking or auditing the Windows Run dialog (Win+R) if it is not needed for daily work. It also advises training employees to recognise ClickFix-style prompts that instruct them to paste commands into Terminal or the Run dialog. The researchers attribute the findings to activity observed in Redmond and provide the technical chain and indicators described above.
Microsoft declined to answer The Register’s questions about how many organisations were targeted or victimised in this campaign, and it did not identify which attacker or criminal crew is responsible.
TerminalFix is a compact illustration of how easily convenience and legitimate tools can be combined into a persistent, network-level access capability. The attack uses familiar components — a signed host executable, PowerShell, scheduled tasks — but chains them with steganography and a custom WebSocket tunnel to reach beyond a single compromised workstation. That combination is what defenders must learn to detect and disrupt.
