Microsoft Details TerminalFix ClickFix Variant Using Fake Cloudflare CAPTCHAs
This digest was compiled by AI from multiple sources — links to the originals are below.
Microsoft disclosed a new ClickFix variant, TerminalFix, that tricks users into running malicious commands in Windows Terminal or PowerShell. The campaign uses compromised websites to serve fake Cloudflare CAPTCHA verifications, leading to a reverse-tunnel backdoor. The attack chain involves DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance.
Key Facts
- TerminalFix directs victims to Windows Terminal or PowerShell instead of the Windows Run dialog, increasing the likelihood that complex multi-line scripts execute successfully.
- The PowerShell command downloads a ZIP archive containing a legitimate binary, LockScreenContentServer.exe, and a rogue DLL, dui70.dll, to initiate DLL sideloading.
- The sideloaded DLL retrieves next-stage payloads hidden within PNG images from external domains bestsocialmedianewspapper.com or offlineupdater.com.
- The Python-based reverse-tunnel implant, client.py, tunnels arbitrary TCP traffic to attacker-controlled infrastructure at gitnow.dev:443 through an encrypted WebSocket channel.
- Microsoft warns that the access can be abused to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware.
Attack Chain
The attack begins with compromised websites serving fake Cloudflare CAPTCHA verifications that prompt visitors to copy and execute a malicious PowerShell command. The PowerShell command downloads a ZIP archive containing LockScreenContentServer.exe and dui70.dll to initiate a DLL sideloading attack. The sideloaded DLL retrieves next-stage payloads hidden within PNG images from external domains bestsocialmedianewspapper.com or offlineupdater.com. It establishes persistence via Registry Run keys and scheduled tasks, carries out domain reconnaissance, and deploys a Python-based reverse-tunnel command-and-control implant.
Reconnaissance and Persistence
The reconnaissance phase collects system metadata, performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches. The attack pings named servers to map the internal network topology. A persistent PowerShell file-watch loop monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file.
Reverse-Tunnel Backdoor
The backdoor, client.py, tunnels arbitrary TCP traffic back to attacker-controlled infrastructure at gitnow.dev:443 through an encrypted WebSocket channel. It enables the C2 server to reach any host visible from the victim's network. Microsoft stated that this type of intrusion provides attackers with direct access to an organization's internal network through the reverse tunnel. The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host.
1 source
Microsoft Details TerminalFix ClickFix Variant Using Fake Cloudflare CAPTCHAs
