Microsoft Threat Intelligence has identified a new campaign named TerminalFix, a variant of ClickFix, which is targeting organizations across various sectors. This campaign employs compromised websites to present a fake Cloudflare CAPTCHA verification overlay, deceiving users into executing a malicious PowerShell command. Unlike traditional ClickFix campaigns that redirect victims to the Windows Run dialog, TerminalFix directs users to Windows Terminal or PowerShell, enhancing the chances of executing complex multi-line scripts successfully. This campaign is more sophisticated than earlier variants, deploying a multi-stage attack chain that includes DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant, thereby granting attackers persistent network-level proxy access through the compromised host. For further details, see the analysis by Microsoft Threat Intelligence.
Attack Chain Overview
The TerminalFix campaign follows a multi-stage attack chain that progresses from social engineering through payload delivery, persistence, reconnaissance, and ultimately network tunneling:
- Initial access via compromised website: A compromised website displays a fake Cloudflare Turnstile CAPTCHA verification overlay, instructing the user to copy and paste a “verification” command.
- PowerShell execution: The pasted command runs a disguised PowerShell script that downloads a ZIP archive from attacker infrastructure, extracts it to C:ProgramData, and silently launches a batch file.
- DLL sideloading: The batch file executes LockScreenContentServer.exe, a signed legitimate binary, which automatically loads the co-located malicious dui70.dll.
- Steganographic payload retrieval: The sideloaded DLL executes PowerShell that downloads PNG images from attacker domains, extracts embedded executables and DLL fragments hidden within pixel data, and reassembles them on disk.
- Persistence: The malware establishes persistence through both HKCU…Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes.
- Reconnaissance: Extensive domain discovery is performed, including domain trust enumeration, domain admin group membership, Active Directory computer and user enumeration, targeted server pinging, and system information collection in multiple languages.
- Command execution loop: A persistent PowerShell file-watch loop monitors a text file for new commands, executes them, and writes results to an output file, creating an asynchronous command shell.
- Reverse tunnel deployment: A Python runtime and a custom tunneling implant are downloaded and launched, establishing a reverse WebSocket tunnel to gitnow[.]dev, providing the attacker with full TCP proxy access through the victim’s network.
Mitigation and Protection Guidance
Microsoft recommends several mitigations to reduce the impact of this threat:
- Restrict PowerShell and Run dialog execution using AppLocker or Group Policy.
- Monitor for DLL sideloading indicators, particularly for LockScreenContentServer.exe executing from non-standard paths.
- Educate users about ClickFix tactics to recognize fake CAPTCHA verification pages.
- Investigate affected hosts thoroughly, assuming network-level access through compromised machines.
- Enable network protection and web protection in Microsoft Defender for Endpoint.
Follow Cyber Warriors Middle East for further ransomware, cybercrime and DarkWatch developments.
