Microsoft has issued a warning about a new variant of the ClickFix social engineering technique called TerminalFix. The attack leverages fake Cloudflare CAPTCHA prompts displayed on compromised websites to deceive victims. Users are tricked into copying and running malicious PowerShell commands in Windows Terminal. The campaign deploys reverse tunnels as part of its payload delivery or persistence mechanism. TerminalFix represents an evolution of the ClickFix attack pattern, expanding the attack surface beyond the Run dialog to Windows Terminal. The use of reverse tunnels suggests the attackers seek persistent, covert access to compromised systems. This technique is particularly dangerous as it abuses legitimate user interfaces and trusted brand names like Cloudflare.
TerminalFix is a ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal. Unlike typical ClickFix attacks, it runs multi-line scripts and establishes a reverse tunnel into the victim's internal network. The infection chain: (1) Victim is shown a fake CAPTCHA prompt that preloads a PowerShell command into the clipboard; (2) The command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL that decodes and launches an obfuscated payload in memory via DLL sideloading; (3) In the second stage, steganography is used to hide executables and DLL fragments in the pixel data of three PNG images downloaded from the C2 server, which are then reassembled on disk; (4) Persistence is established via a scheduled task (running hourly) and a Registry Run key; (5) The malware performs reconnaissance including probing for domain controllers, databases, backup servers, gateways, and mail systems, collecting system information, and enumerating Active Directory; (6) A custom Python reverse-tunnel module connects outbound to gitnow[.]dev:443 over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying. The tunnel supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown. This turns the infected endpoint into a network pivot, enabling lateral movement to systems discovered during AD and network reconnaissance. Potential post-compromise actions include lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware deployment.
1. Restrict and log PowerShell execution to detect malicious script activity. 2. Monitor for 'LockScreenContentServer.exe' running outside its normal path. 3. Harden browsers and endpoint protections to prevent ClickFix-style social engineering. 4. Monitor for scheduled tasks and Registry Run keys created by unauthorized processes. 5. Block or alert on outbound WebSocket connections to gitnow[.]dev:443. 6. If compromise is confirmed, investigate for lateral movement across the network. 7. Rotate credentials, including domain admin credentials, if the infected host had access to them. 8. Monitor for unusual Active Directory enumeration activity. 9. Inspect network traffic for SOCKS5-style proxying patterns indicative of reverse tunnels. 10. Educate users not to execute clipboard-injected commands prompted by CAPTCHA-like prompts.
gitnow[.]dev:443, LockScreenContentServer.exe
