New “TerminalFix” Attacks Use Fake CAPTCHAs to Hijack Corporate Networks
Microsoft has issued a stern warning regarding a sophisticated new threat campaign dubbed “TerminalFix.” This evolving variant of the well-known “ClickFix” social engineering attack leverages deceptive browser-based CAPTCHA prompts to manipulate victims into executing malicious PowerShell commands directly within Windows Terminal.
Unlike typical ClickFix campaigns, which are often designed for simple credential theft or the deployment of basic infostealers, TerminalFix is engineered for deeper infiltration. By exploiting Windows Terminal, attackers can execute complex, multi-line scripts that establish a robust foothold, effectively turning compromised machines into gateways for broader network attacks.
The Attack Vector: Deception via Windows Terminal
The attack begins when a user visits a compromised website and is presented with a fake Cloudflare-style CAPTCHA prompt. The prompt instructs the user to “verify” their humanity by copying a command to their clipboard and executing it in the Windows Terminal or PowerShell.
Once the user executes the command, the infection process triggers a multi-stage intrusion chain:
- Initial Payload: The command downloads a ZIP archive containing a legitimate, signed executable alongside a malicious DLL. The DLL is designed to decode and launch a payload directly into the system’s memory, bypassing traditional disk-based detection.
- Steganographic Concealment: In a move to evade security software, the threat actors hide executable components and DLL fragments within the pixel data of three innocuous-looking PNG images. The script retrieves these images from a command-and-control (C2) server and reassembles the malicious binary on the disk.
- Persistence: The malware ensures it remains on the system by creating a scheduled task and a Registry Run key, which trigger the malicious code hourly.
From Infiltration to Network Pivot
Once the malware is established, it initiates an aggressive reconnaissance phase. It probes the environment for domain controllers, mail systems, backup servers, and databases, while also enumerating Active Directory (AD) to identify high-value targets.
The core of the threat is a custom Python-based reverse-tunnel module. This module connects to the attacker’s C2 infrastructure (notably gitnow[.]dev) via an encrypted WebSocket. This allows for SOCKS5-style arbitrary TCP proxying, effectively granting the attacker full remote access to internal network resources that are normally shielded from the public internet.
By turning the infected endpoint into a network pivot, the threat actor can perform lateral movement, escalate privileges, steal sensitive credentials, or even deploy ransomware across the entire organization.
Expert Recommendations
Microsoft researchers emphasized that while they have not observed “hands-on” manual activity yet, the potential for catastrophic damage is high. The TerminalFix campaign demonstrates how quickly a user-driven error can escalate into a full-scale network breach.
To defend against this threat, security teams are advised to:
- Restrict PowerShell: Limit the ability of standard users to execute PowerShell scripts or use Group Policy to log and audit command-line activity.
- Monitor System Processes: Keep a close eye on
LockScreenContentServer.exeand ensure it only executes from its legitimate file path. - Harden Endpoints: Enhance browser security settings and ensure endpoint protection platforms are configured to detect suspicious steganographic payloads.
- Incident Response: If a breach is confirmed, organizations should immediately begin an investigation into lateral movement and rotate all domain credentials, especially those for administrative accounts that could have been accessed by the compromised host.
