Listen to this Post
Introduction: A Familiar Security Trick Has Entered a More Dangerous Terminal
Cybercriminals do not always need a sophisticated zero-day vulnerability to break into an organization. Sometimes, all they need is a convincing webpage, a fake CAPTCHA, and a victim willing to copy and paste a command.
Microsoft has now disclosed a dangerous evolution of the increasingly common ClickFix technique, a campaign the company calls TerminalFix. Instead of directing victims toward the traditional Windows Run dialog, the attackers convince them to execute malicious commands directly inside Windows Terminal or PowerShell.
That small change has major security consequences.
A terminal can execute complex, multi-line commands far more effectively than a simple Run dialog. Once the victim pastes and executes the command, the attack can rapidly move through multiple stages, including DLL sideloading, hidden payload extraction, Active Directory reconnaissance, persistence mechanisms, and the deployment of a reverse tunnel capable of giving attackers deep access to an organization’s internal network.
This is what makes TerminalFix particularly concerning. The initial infection may depend on social engineering, but the activity that follows resembles a serious enterprise intrusion.
Microsoft’s findings show how modern attackers increasingly combine human deception with legitimate Windows functionality. Rather than relying exclusively on obviously malicious software, they abuse trusted tools, legitimate binaries, PowerShell, scheduled tasks, registry settings, Python scripts, encrypted WebSockets, and internal network discovery techniques.
The result is an attack chain designed not simply to compromise one computer, but potentially to transform that computer into a gateway into the rest of the corporate environment.
Original Summary: TerminalFix Expands the ClickFix Threat
Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan disclosed details of a new ClickFix variant known as TerminalFix.
Traditional ClickFix campaigns typically trick victims into opening the Windows Run dialog and executing a malicious command. TerminalFix uses the same psychological technique but instead directs users toward Windows Terminal or PowerShell.
The campaign targets organizations across multiple sectors and begins with compromised websites displaying fake Cloudflare CAPTCHA-style verification pages.
Visitors are instructed to copy and execute a PowerShell command as part of the supposed verification process.
Instead of proving they are human, victims unknowingly begin a multi-stage compromise.
The malicious PowerShell command downloads a ZIP archive containing a legitimate executable named LockScreenContentServer.exe alongside a malicious DLL called dui70.dll.
The attackers then abuse DLL sideloading to load the malicious DLL through the legitimate executable.
After execution, the rogue DLL retrieves additional payloads hidden inside PNG images hosted on external domains.
The malware establishes persistence through Registry Run keys and scheduled tasks.
It then begins collecting system information and performing Active Directory reconnaissance.
The attackers search for domain trusts, domain administrators, users, computers, and other systems visible inside the environment.
The compromised machine can also be used to map internal network infrastructure by communicating with named servers.
A Python-based reverse-tunnel implant called client.py is eventually deployed.
This implant can tunnel arbitrary TCP traffic through an encrypted WebSocket connection to attacker-controlled infrastructure.
That capability can allow the attackers to reach systems that are visible from the infected machine but may not be directly accessible from the public internet.
Microsoft warned that this type of access could support further privilege escalation, security control evasion, data theft, and ransomware deployment.
The Fake CAPTCHA Problem: When Verification Becomes the Infection Vector
The first stage of TerminalFix is deceptively simple.
A victim visits what appears to be a legitimate website.
The site may have been compromised by attackers rather than created specifically for the campaign.
Instead of displaying the expected content, the visitor encounters a fake Cloudflare CAPTCHA or verification screen.
The page creates a sense of legitimacy because CAPTCHA challenges have become a normal part of browsing the modern internet.
Users are accustomed to proving they are human.
Attackers are exploiting that familiarity.
Instead of asking the victim to click an image or solve a challenge, the malicious page instructs them to copy and execute a command.
This is the core philosophy behind ClickFix attacks.
The victim performs the final step of the compromise personally.
That creates a difficult security problem because traditional defenses often focus heavily on malicious files, suspicious downloads, or exploits.
In this case, the victim may be convinced to open a trusted Windows application and manually execute the attacker’s instructions.
The terminal itself is not malicious.
PowerShell itself is not malicious.
The command becomes dangerous because the user unknowingly gives the attacker permission to execute it.
Why Windows Terminal Makes TerminalFix More Dangerous
Traditional ClickFix attacks often relied on the Windows Run dialog.
That approach has limitations.
Complex commands may be difficult to paste correctly.
Multi-stage scripts can be awkward to execute.
Long instructions may also increase the likelihood that something goes wrong.
TerminalFix changes the environment.
Windows Terminal and PowerShell are designed specifically to execute commands and scripts.
They can process complex PowerShell instructions.
They can handle longer commands.
They can execute encoded or obfuscated content.
They also provide attackers with a familiar environment for downloading files, launching processes, modifying system settings, and interacting with the operating system.
For attackers, this makes TerminalFix a more flexible version of the ClickFix model.
The social engineering component remains simple.
The technical execution becomes significantly more powerful.
The First Payload: A ZIP Archive With a Legitimate Binary and Rogue DLL
After the victim executes the malicious PowerShell command, the next stage begins.
The command downloads a ZIP archive.
Inside the archive are two important components.
The first is a legitimate executable called LockScreenContentServer.exe.
The second is a malicious DLL named dui70.dll.
This combination supports a technique known as DLL sideloading.
DLL sideloading abuses the trust placed in legitimate applications.
A legitimate executable may attempt to load a DLL with a specific name.
If an attacker can place a malicious DLL where the application expects it, the trusted executable may load the attacker’s code.
This creates an especially dangerous situation.
Security products may initially recognize the legitimate executable as harmless.
The executable itself may be digitally signed or otherwise trusted.
However, the process becomes malicious because of the DLL it loads.
This technique allows attackers to hide malicious activity behind a legitimate Windows or software component.
DLL Sideloading: Abusing Trust Inside the Operating System
DLL sideloading continues to be an attractive technique for sophisticated attackers.
Organizations often maintain allowlists of trusted applications.
Security teams may also monitor unknown executables more aggressively than familiar binaries.
Attackers understand this.
Instead of introducing a completely unknown executable, they can abuse a legitimate application as a launcher.
The legitimate program provides the appearance of trust.
The malicious DLL provides the functionality.
Together, they create a dangerous combination.
TerminalFix uses this technique as part of its multi-stage infection chain.
The initial PowerShell command does not need to contain every malicious capability.
Instead, it downloads the components needed to begin the next phase.
This modular design also makes the campaign more flexible.
Attackers can potentially change later payloads without completely redesigning the initial infection process.
Hidden Inside Images: Steganography Adds Another Layer of Concealment
The sideloaded DLL retrieves additional payloads hidden inside PNG images.
This technique uses steganography.
At first glance, the downloaded files may appear to be ordinary images.
Security systems may not immediately treat an image file as an executable payload.
However, the image can contain hidden data.
The malware can extract the concealed content and reconstruct the next stage of the attack.
Microsoft observed payload retrieval from external domains including:
bestsocialmedianewspapper[.]com
offlineupdater[.]com
This approach adds another layer of deception.
The attackers are not simply downloading an executable called malware.exe.
They are using apparently harmless image files as containers for malicious content.
This can complicate detection and analysis.
Network monitoring systems that focus only on obvious executable downloads may miss suspicious activity involving image resources.
Persistence: Making Sure the Attack Survives Reboots
A successful compromise is far more valuable when it survives a system restart.
TerminalFix uses multiple persistence mechanisms.
Microsoft observed Registry Run keys being used to automatically launch malicious components.
Scheduled tasks were also used.
Using multiple persistence mechanisms increases resilience.
If one method is discovered and removed, another may remain active.
Persistence is a critical phase of enterprise intrusion activity.
Without it, attackers risk losing access when the user logs out or the computer restarts.
With persistence, the compromised system can continue communicating with attacker infrastructure over an extended period.
This gives adversaries more time to understand the environment.
It also gives them more opportunities to move deeper into the network.
Active Directory Reconnaissance: The Attack Begins Mapping the Organization
Once the malware is established, reconnaissance begins.
This is where the attack becomes much more dangerous for enterprise environments.
The attackers collect system metadata.
They investigate Active Directory.
They enumerate domain trusts.
They search for domain administrators.
They identify users and computers.
They also communicate with named servers to understand the internal network topology.
This information is extremely valuable.
An attacker who compromises a single workstation may initially know very little about the organization.
Reconnaissance changes that.
The compromised endpoint can become an observation point inside the network.
The attackers can begin identifying important systems.
They can search for administrative accounts.
They can locate domain relationships.
They can identify possible paths toward more valuable infrastructure.
This is often the stage where a seemingly isolated endpoint compromise develops into a much larger security incident.
The Reverse Tunnel: Turning One Infected Machine Into a Network Gateway
One of the most serious features of TerminalFix is the deployment of a Python-based reverse-tunnel implant called client.py.
The implant can tunnel arbitrary TCP traffic back to attacker-controlled infrastructure.
Microsoft observed communication associated with:
gitnow[.]dev:443
The tunnel uses an encrypted WebSocket channel.
This creates a powerful capability.
The attacker can potentially use the infected computer as a bridge into the organization’s internal network.
Systems that are not directly exposed to the internet may still be reachable from the compromised machine.
The reverse tunnel can provide attackers with a pathway to communicate with those internal systems.
This is why Microsoft described the capability as particularly dangerous.
A single infected endpoint can become more than a victim.
It can become a proxy.
It can become a pivot point.
It can become an operational gateway into a much larger network.
The File-Watch Loop: A Persistent Command Execution Mechanism
The campaign also deploys a PowerShell file-watch loop.
The mechanism monitors a text file for new commands.
When new instructions appear, the script executes them using Invoke-Expression.
The results are then written to an output file.
This gives the attackers another way to interact with the compromised system.
File-based command execution can be useful when attackers want to separate command delivery from the initial payload.
The implant can continuously watch for instructions.
New commands can be added.
The system executes them.
Results are collected.
From a
PowerShell scripts that continuously monitor files and dynamically execute their contents can represent a major security risk, especially when combined with obfuscated commands or unusual persistence mechanisms.
Why Enterprise Networks Are the Real Target
The initial victim may only be one employee.
The real objective may be much larger.
Microsoft’s findings suggest that TerminalFix is built with enterprise reconnaissance and network access in mind.
The malware investigates Active Directory.
It identifies administrators.
It searches for systems.
It maps network relationships.
It establishes a reverse tunnel.
These are not capabilities designed merely to display unwanted advertisements.
They are capabilities that can support deeper intrusion operations.
An attacker with access to an internal network can potentially attempt privilege escalation.
They may target additional systems.
They may attempt to disable security tools.
They may search for valuable data.
They may steal credentials.
They may exfiltrate sensitive information.
They may ultimately deploy ransomware across the environment.
The danger comes from the combination of capabilities.
TerminalFix is not just a malicious PowerShell command.
It is an entry point into a structured attack chain.
From Social Engineering to Ransomware Risk
Microsoft warned that the access provided by the campaign could be abused to escalate privileges, disable security controls, steal sensitive data, and deploy ransomware.
This demonstrates an important reality about modern cyberattacks.
The first stage does not always reveal the final objective.
A fake CAPTCHA may appear harmless.
A copied command may seem like a technical verification step.
The victim may believe they are fixing a browser issue.
Minutes or hours later, the attacker may have persistence inside the system.
Later, the compromised machine may be used to investigate the corporate network.
Eventually, the intrusion could support a far more destructive operation.
Ransomware incidents frequently involve multiple stages.
Initial access is followed by reconnaissance.
Reconnaissance is followed by credential access or privilege escalation.
Attackers then move laterally.
Data may be stolen.
Finally, ransomware can be deployed.
TerminalFix demonstrates how a simple social engineering technique can potentially initiate the first stage of that larger process.
Defending Against TerminalFix Starts With Reducing Dangerous User Actions
Microsoft recommends restricting PowerShell and Windows Run dialog execution for standard users where appropriate.
Organizations can use AppLocker.
Application Control for Windows can also help control which applications and scripts are allowed to execute.
Group Policy can reduce unnecessary execution opportunities.
Organizations should also evaluate whether the Windows Run dialog is necessary for standard users.
If it is not required, restricting or auditing its use can reduce exposure to traditional ClickFix techniques.
However, technical controls alone are not enough.
Users must understand that legitimate CAPTCHA systems should not ask them to open PowerShell and execute commands.
A website should not require a visitor to paste complex commands into Windows Terminal to prove they are human.
That should immediately be treated as suspicious.
Employee Awareness Must Evolve With the Attack
Security awareness training often focuses on phishing emails.
That is no longer enough.
Users must also understand malicious browser instructions.
They must recognize fake CAPTCHA pages.
They must question instructions that require copying commands.
They must understand that a website asking them to open PowerShell is highly unusual.
ClickFix attacks succeed because they exploit trust.
The attacker does not always need to send a malicious attachment.
They can manipulate the victim into executing the malicious command themselves.
Organizations should train employees to stop and verify unexpected technical instructions.
A few seconds of skepticism can prevent a much larger incident.
PowerShell Logging Can Reveal the Attack Chain
Microsoft also recommends enabling PowerShell script block logging.
This can provide defenders with valuable visibility into PowerShell activity.
Obfuscated or encoded commands may still leave useful evidence.
Security teams can investigate unusual script execution.
They can search for suspicious download commands.
They can identify encoded PowerShell activity.
They can detect attempts to execute content through dangerous functions such as Invoke-Expression.
Logging is particularly important because attackers increasingly abuse legitimate administrative tools.
PowerShell is widely used by administrators.
That means organizations cannot simply assume every PowerShell process is malicious.
The goal is visibility.
Security teams need enough telemetry to distinguish normal administrative activity from suspicious behavior.
What Undercode Say:
The Human Is Becoming the New Exploit
TerminalFix demonstrates a dangerous shift in the cyber threat landscape.
Attackers increasingly understand that exploiting software is difficult, expensive, and unreliable.
Manipulating a human can sometimes be easier.
A fake CAPTCHA does not need to bypass a patched vulnerability.
It only needs to look believable.
The attacker is effectively outsourcing execution to the victim.
The victim opens the terminal.
The victim pastes the command.
The victim authorizes the process.
This creates a powerful form of social engineering.
TerminalFix Exploits Trust in Legitimate Windows Tools
The attack does not begin with an obviously malicious application.
It abuses PowerShell.
It uses Windows Terminal.
It relies on a legitimate executable.
It abuses DLL sideloading.
It uses scheduled tasks.
It modifies persistence settings.
It communicates through encrypted WebSockets.
Every stage attempts to hide inside normal technology.
This is the real challenge for defenders.
Blocking every legitimate tool is impossible.
Understanding how those tools are abused is essential.
The Reverse Tunnel Is the Most Strategically Dangerous Component
The fake CAPTCHA gets attention because it is the visible part of the attack.
The reverse tunnel is potentially the more serious long-term capability.
Once attackers gain a reliable internal proxy, the compromised endpoint becomes a bridge.
The network perimeter becomes less relevant.
The attacker may no longer need direct internet access to every internal system.
They can potentially operate through the infected machine.
This is why segmentation matters.
A workstation should not automatically have unrestricted access to sensitive infrastructure.
Active Directory Reconnaissance Suggests a Bigger Objective
The malware does not simply collect basic information.
It investigates domain relationships.
It searches for administrators.
It enumerates users and computers.
That behavior indicates an interest in the broader environment.
This is a warning sign for defenders.
When an endpoint begins aggressively querying Active Directory, the incident should not be treated as a simple malware infection.
The organization should investigate whether the attacker has already begun preparing for lateral movement.
Steganography Shows Why File Type Alone Is Not Enough
A PNG image is normally considered harmless.
TerminalFix demonstrates why assumptions based purely on file extensions can fail.
Malicious content can be hidden inside apparently legitimate formats.
Security teams should inspect unusual downloads based on behavior and context.
An endpoint downloading multiple image files from suspicious domains should not automatically be ignored.
Detection needs to consider the entire chain.
DLL Sideloading Remains a Powerful Evasion Technique
Trusted binaries can become attack vehicles.
That makes application reputation alone insufficient.
Security products should examine process relationships.
They should investigate unexpected DLL loads.
They should detect unusual binaries executing from temporary or user-controlled locations.
The legitimate executable is only one part of the story.
Defenders must understand what it loads.
ClickFix Is a Training Problem and a Technical Problem
Many organizations will focus only on blocking PowerShell.
That approach can create operational problems.
PowerShell is essential in many enterprise environments.
The better strategy is layered defense.
Restrict unnecessary execution.
Use application control.
Enable logging.
Monitor suspicious commands.
Train users.
Segment networks.
Detect unusual persistence.
No single control will solve the problem.
Security Teams Should Hunt for the Entire Attack Pattern
Searching only for the malicious domains may not be enough.
Attackers can change infrastructure.
Searching only for file hashes may not be enough.
Attackers can rebuild payloads.
Defenders should focus on behaviors.
PowerShell launching downloads.
Unexpected ZIP archives.
DLL sideloading.
PNG-based payload retrieval.
Registry Run key persistence.
Suspicious scheduled tasks.
Python reverse tunnels.
Encrypted WebSocket connections.
Active Directory reconnaissance.
These behaviors create a stronger detection strategy than a single indicator.
The Biggest Lesson Is Simple: Never Paste Commands From a Website
A legitimate website should not require users to execute PowerShell commands to complete a CAPTCHA.
It should not ask users to paste scripts into Windows Terminal.
It should not instruct employees to disable security protections.
Organizations should make this rule extremely clear.
If a website asks a user to manually execute a command, stop.
Verify the instruction through a trusted channel.
That single habit could prevent an entire compromise.
Deep Analysis
Investigating Suspicious PowerShell Activity
Security teams can review PowerShell processes and suspicious command lines using:
Get-Process powershell
Administrators can inspect recent PowerShell-related activity through Windows event logs:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
Defenders should pay close attention to encoded commands:
powershell.exe -EncodedCommand
On Linux-based SIEM or forensic environments, suspicious indicators can be searched through collected logs:
grep -Ri "EncodedCommand" /var/log/
Hunting for Registry Run Key Persistence
Defenders can inspect common persistence locations:
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
They can also inspect machine-wide persistence:
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Suspicious entries pointing toward unusual user directories, temporary locations, or unknown executables should be investigated.
Reviewing Scheduled Tasks
Attackers frequently use scheduled tasks for persistence.
Administrators can inspect them using:
Get-ScheduledTask
A more targeted investigation can search for suspicious task names or commands:
schtasks /query /fo LIST /v
Security teams should investigate tasks launching PowerShell, Python, temporary executables, or files stored in unusual directories.
Hunting for Suspicious DLL Sideloading
Windows administrators can inspect running processes and loaded modules:
Get-Process | Select-Object ProcessName,Id,Path
On forensic systems, analysts can use Sysinternals tooling and EDR telemetry to identify unusual DLL loading relationships.
The key question is not simply whether the executable is trusted.
The question is whether the executable is loading expected libraries from expected locations.
Searching for Network Connections
Investigators can review active network connections:
Get-NetTCPConnection
They can also inspect processes associated with connections:
netstat -ano
On Linux monitoring systems, analysts can search network telemetry for suspicious WebSocket or proxy activity:
ss -tunap
Unexpected encrypted connections from user workstations to unknown infrastructure deserve investigation.
Looking for Python-Based Tunnels
Because TerminalFix deploys a Python-based reverse tunnel, organizations should investigate unexpected Python execution on systems where Python is not normally required.
On Windows:
Get-Process python
On Linux:
ps aux | grep python
Unexpected Python scripts maintaining persistent outbound connections may indicate tunneling or unauthorized remote access.
Investigating Active Directory Reconnaissance
Defenders should monitor unusual enumeration behavior involving:
Get-ADUser -Filter
And:
Get-ADComputer -Filter
Attackers frequently use directory information to identify privileged accounts and valuable systems.
High-volume or unusual enumeration from ordinary user workstations should be investigated.
Building Detection Around Behavior
The strongest defense against TerminalFix is behavioral detection.
A useful investigation chain may look like this:
Fake CAPTCHA → User executes PowerShell → ZIP download → DLL sideloading → PNG payload extraction → Persistence → Active Directory reconnaissance → Reverse tunnel
Any organization capable of detecting multiple stages in this chain has a much better chance of stopping the intrusion before it develops into a larger enterprise compromise.
✅ Microsoft has documented a ClickFix variant called TerminalFix that tricks victims into executing malicious commands through Windows Terminal or PowerShell rather than relying only on the traditional Windows Run dialog.
✅ The reported attack chain includes DLL sideloading, payload concealment inside PNG files, persistence mechanisms, Active Directory reconnaissance, and a reverse-tunnel capability that can provide attackers with deeper access to internal networks.
✅ Microsoft’s recommended defensive approach includes restricting unnecessary PowerShell execution, monitoring DLL sideloading behavior, improving employee awareness of ClickFix attacks, and enabling PowerShell script block logging for greater visibility.
Prediction
(+1) TerminalFix-style attacks will likely become more common because fake CAPTCHA pages and copy-and-paste instructions exploit ordinary user behavior rather than depending entirely on software vulnerabilities.
Security vendors will increasingly build detections specifically for suspicious browser-to-terminal activity, especially websites that attempt to convince users to execute PowerShell commands.
Enterprises will place greater emphasis on restricting administrative scripting capabilities for standard users while improving logging and behavioral monitoring.
Attackers will likely continue adapting ClickFix campaigns by changing delivery mechanisms, domains, payload formats, and trusted Windows components to evade static detection.
Organizations that rely only on antivirus signatures may face increasing difficulty detecting multi-stage attacks that combine legitimate tools with social engineering and network tunneling.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
