TL;DR
- what: Microsoft disclosed TerminalFix, a ClickFix variant that uses fake Cloudflare CAPTCHA pages on compromised websites to get users to paste a malicious PowerShell command into Windows Terminal or PowerShell.
- impact: The chain sideloads a rogue dui70.dll, pulls PNG-steganography payloads, enumerates Active Directory, and drops a Python reverse-tunnel implant that gives the operator network-level proxy access to any host the victim machine can see.
- fix: Microsoft recommends restricting PowerShell and Run dialog execution for standard users via AppLocker, App Control for Windows, or Group Policy, blocking or auditing Win+R where it is not needed, and enabling PowerShell script block logging; there is no CVE or patch because this is user-driven execution, not a software flaw.
- who: Windows enterprise environments across multiple sectors, especially those where standard users can run arbitrary PowerShell and where domain-joined workstations sit on flat internal networks.
Microsoft has published analysis of TerminalFix, a ClickFix variant that ends with an attacker holding a network-level proxy inside your environment. The initial access is a fake Cloudflare CAPTCHA served from a compromised website. The final stage is a Python implant that tunnels arbitrary TCP traffic to attacker infrastructure over an encrypted WebSocket, and lets the C2 server reach any host the infected machine can see. There is no exploit and no CVE. A user copies a command and pastes it.
The change from prior ClickFix campaigns is small and effective. Traditional ClickFix sends the victim to the Windows Run dialog, which is a poor host for long or multi-line payloads. TerminalFix sends them to Windows Terminal or PowerShell instead. Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan note that this materially increases the odds that complex, multi-line scripts execute successfully. Attackers traded a slightly longer social engineering script for a far more reliable execution surface.
The chain, stage by stage
The full sequence is more disciplined than most commodity ClickFix activity. It uses living-off-the-land execution, a signed-binary sideload, and payload staging that does not look like malware in transit.
- Compromised website serves a fake Cloudflare CAPTCHA verification prompt to visitors.
- Victim is instructed to copy a PowerShell command and run it in Windows Terminal or PowerShell.
- The command downloads a ZIP containing a legitimate binary, LockScreenContentServer.exe, and a rogue dui70.dll.
- Launching the legitimate binary sideloads the rogue DLL.
- The DLL retrieves next-stage payloads hidden inside PNG images hosted on bestsocialmedianewspapper[.]com and offlineupdater[.]com.
- Persistence is established twice over: a Registry Run key and a scheduled task.
- Domain reconnaissance runs, then a Python reverse-tunnel implant, client.py, is deployed.
- The implant tunnels TCP over an encrypted WebSocket to gitnow[.]dev:443.
Two details deserve attention from detection engineers. First, the steganographic staging means the second stage crosses the wire as a PNG from a domain that looks like a news or software update site. Content inspection on the download will not flag it. Second, the C2 rides WebSocket on 443, which blends into normal outbound HTTPS in nearly every enterprise egress policy.
Reconnaissance before the tunnel
Before the implant goes up, TerminalFix maps the environment. Microsoft describes system metadata collection, domain trust discovery, domain admin enumeration, Active Directory user and computer searches, and pings against named servers to sketch the internal network topology. That is the target list for whatever comes next. By the time the tunnel is live, the operator already knows which hosts are worth reaching.
The campaign also drops a persistent PowerShell file-watch loop. It monitors a text file for new commands, executes them through Invoke-Expression, and writes results to an output file. It is a crude second channel, and it is durable: no network beacon of its own, just a script polling a file on disk. If the Python implant is removed and the watcher is not, the operator retains a foothold.
⚠️ Reverse tunnel means your perimeter is now their perimeter — The implant does not just take commands. It lets the C2 server reach any host visible from the victim machine. One compromised standard-user workstation on a flat internal network converts directly into attacker access to every service that workstation can route to, including systems that have never been exposed to the internet. Microsoft warns this access supports privilege escalation, disabling security controls, data exfiltration, and ransomware deployment.
Why this defeats the usual controls
Most of the enterprise stack is built to stop something from being delivered or exploited. TerminalFix delivers nothing that has to bypass a filter. The user opens the terminal, the user pastes the command, and the process tree that follows is rooted in a legitimate user session. The sideload host, LockScreenContentServer.exe, is a signed Microsoft binary. The C2 is outbound TLS on 443. The persistence is two of the most common mechanisms on Windows, which means high-volume, high-noise telemetry that many teams have tuned down.
The single strongest control here is not a detection. It is removing the capability. If standard users in your environment do not need to run arbitrary PowerShell, the entire chain never starts.
What to do this week
Microsoft's guidance is straightforward, and most of it is configuration rather than procurement.
- Restrict PowerShell and Run dialog execution for standard users using AppLocker, App Control for Windows, or Group Policy.
- Block or audit the Windows Run dialog (Win+R) where it is not operationally required.
- Enable PowerShell script block logging so obfuscated and encoded commands are recoverable for analysis, not just observed as opaque blobs.
- Alert on DLL sideloading patterns: an unsigned or unexpected DLL loading next to a signed binary in a user-writable directory, especially anything named dui70.dll outside System32.
- Hunt for the named infrastructure: gitnow[.]dev, bestsocialmedianewspapper[.]com, offlineupdater[.]com.
- Look for Registry Run key and scheduled task creation that immediately follows a user-initiated powershell.exe or wt.exe session.
- Search for PowerShell processes running long-lived loops that read a text file and call Invoke-Expression.
Update the awareness training, then verify it — The delivery pitch is a Cloudflare CAPTCHA, a brand your users see constantly and have been trained by ordinary browsing to click through without thought. Tell staff plainly: no legitimate CAPTCHA, verification page, or website of any kind will ever ask you to open a terminal and paste a command. Then confirm the control side holds, because awareness training is a mitigation with a known failure rate, and this chain only needs one paste.
Bottom line
TerminalFix is not technically novel in any single component. DLL sideloading, PNG steganography, Run key persistence, and WebSocket tunneling are all well-documented. What makes it worth an agenda slot is the assembly: a social engineering front end with a high execution success rate, bolted to a reconnaissance and tunneling back end built for lateral movement. Microsoft's assessment is that this is a serious threat to enterprise environments, and the reverse tunnel is why. Treat any confirmed TerminalFix execution as a network intrusion from the moment client.py runs, not as a single infected endpoint.
Originally published on RedEye Threat Intelligence.
