TerminalFix Malware Exploits Fake CAPTCHAs

Microsoft has disclosed a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running malicious commands in Windows Terminal or PowerShell. The campaign leverages compromised websites to serve fake Cloudflare CAPTCHA verifications, prompting visitors to copy and execute a PowerShell command. This technique increases the likelihood that complex, multi-line scripts execute successfully, according to Microsoft.

How TerminalFix Works

Unlike traditional ClickFix campaigns that direct victims to the Windows Run dialog, TerminalFix directs users to Windows Terminal or PowerShell instead. This shift allows attackers to run more sophisticated scripts that might not fit in the Run dialog's input field.

The attack chain begins with a compromised website that displays a fake CAPTCHA. When the user clicks it, they are instructed to copy a PowerShell command and paste it into Terminal. Executing this command downloads a ZIP archive containing a legitimate binary and a rogue DLL, leading to a DLL sideloading attack.

Multi-Stage Intrusion Chain

Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan detailed the attack in an analysis published this week. The intrusion involves DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant.

The sideloaded DLL retrieves next-stage payloads hidden within PNG images from external domains, establishes persistence via Registry Run keys and scheduled tasks, and deploys a Python-based reverse-tunnel command-and-control (C2) implant.

Reverse Tunnel and Network Access

The backdoor, named client.py, is equipped to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure through an encrypted WebSocket channel. This enables the C2 server to reach any host visible from the victim's network, effectively giving attackers network-level access.

Microsoft emphasizes that this type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel.

Reconnaissance and Persistence

The reconnaissance phase includes collecting system metadata, performing domain trust discovery, enumerating domain admins, and searching Active Directory for users and computers. Attackers also ping named servers to map the internal network topology.

The attack delivers a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. This loop ensures ongoing control even after initial compromise.

Potential for Escalation

Microsoft warns that the access gained through TerminalFix could be abused further to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware. This makes TerminalFix a serious threat to enterprise environments.

Mitigation Recommendations

To mitigate the threat, Microsoft advises restricting PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy. Organizations should also consider blocking or auditing the Windows Run dialog (Win+R) if not required, monitor for DLL sideloading indicators, train employees to recognize ClickFix attacks, and enable PowerShell script block logging to detect obfuscated commands.

This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel. The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host.

— Microsoft security researchers

Why This Matters

TerminalFix represents a worrying evolution in social engineering attacks, shifting from simple Run dialog tricks to more powerful Terminal-based execution. As these campaigns grow more sophisticated, enterprises may need to bolster end-user training and enforce stricter execution controls to stay ahead of such threats.