Microsoft has disclosed details of a new ClickFix variant called TerminalFix that tricks users into executing malicious commands via Windows Terminal or PowerShell. Unlike traditional ClickFix campaigns that use the Windows Run dialog, TerminalFix directs victims to Windows Terminal or PowerShell, increasing the likelihood of executing complex payloads. The campaign uses fake Cloudflare CAPTCHA pages as a social engineering lure. The ultimate payload is a reverse-tunnel backdoor, allowing attackers persistent remote access. This technique leverages legitimate-looking CAPTCHA prompts to bypass user suspicion and security controls. The shift to PowerShell/Terminal increases the capability for attackers to run sophisticated scripts. This represents an evolution of the ClickFix social engineering technique. Organizations using Windows environments are at heightened risk from this campaign.
TerminalFix is a ClickFix variant disclosed by Microsoft that tricks users into running malicious commands via Windows Terminal or PowerShell, using fake Cloudflare CAPTCHA pages on compromised websites. The attack chain is multi-stage: (1) Victim visits a compromised site and is shown a fake Cloudflare CAPTCHA that instructs them to copy and execute a malicious PowerShell command. (2) The PowerShell command downloads a ZIP archive containing a legitimate binary ('LockScreenContentServer.exe') and a rogue DLL ('dui70.dll') to initiate DLL sideloading. (3) The sideloaded DLL retrieves next-stage payloads hidden within PNG images via steganography from external domains. (4) Persistence is established via Registry Run keys and scheduled tasks. (5) Extensive Active Directory reconnaissance is performed: system metadata collection, domain trust discovery, domain admin enumeration, AD user/computer searches, and internal network topology mapping via pinging named servers. (6) A Python-based reverse-tunnel C2 implant ('client.py') is deployed, tunneling arbitrary TCP traffic to attacker-controlled infrastructure over an encrypted WebSocket channel (gitnow[.]dev:443). (7) A persistent PowerShell file-watch loop monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. The backdoor enables the C2 server to reach any host visible from the victim's network, facilitating privilege escalation, disabling security controls, data exfiltration, and ransomware deployment.
1. Restrict PowerShell and Run dialog execution for standard users using AppLocker, Application Control for Windows, or Group Policy. 2. Consider blocking or auditing the Windows Run dialog (Win+R) if not required. 3. Monitor for DLL sideloading indicators. 4. Train employees to recognize and avoid ClickFix-style social engineering attacks. 5. Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands. 6. Block or monitor network connections to known malicious domains: bestsocialmedianewspapper[.]com, offlineupdater[.]com, and gitnow[.]dev. 7. Monitor Registry Run keys and scheduled tasks for unauthorized persistence mechanisms. 8. Monitor for suspicious use of Invoke-Expression in PowerShell logs.
bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev:443, LockScreenContentServer.exe, dui70.dll, client.py
