Microsoft Threat Intelligence has discovered a new TerminalFix campaign targeting organizations across multiple industries. The campaign is a variant of the ClickFix technique, but instead of directing victims to the Windows Run dialog, it tricks them into opening Windows Terminal or PowerShell and executing a malicious command.
The attack begins on a compromised website, where a fake Cloudflare CAPTCHA overlay tells the user to copy and run a supposed verification command. The command launches PowerShell, downloads a ZIP archive, extracts it into C:ProgramData, and starts the next stage. The archive contains the legitimate LockScreenContentServer.exe binary and a malicious dui70.dll. The legitimate executable then loads the malicious DLL via DLL sideloading.
The DLL downloads PNG files containing hidden executable data. The malware uses steganography to extract payload fragments from the images and reconstructs them on the compromised system. It also establishes persistence through Registry Run keys and scheduled tasks that periodically launch the sideloaded executable.
The malware then performs extensive Active Directory reconnaissance, including domain trust enumeration, domain administrator discovery, user and computer enumeration, user description collection, targeted server ping sweeps, and system information gathering.
A PowerShell command loop also monitors a text file for new commands, executes them with Invoke-Expression, and saves the results to an output file. In the final stage, the malware downloads a Python runtime and a custom reverse-tunneling client. Running through pythonw.exe, the implant creates an encrypted WebSocket connection to attacker infrastructure and can tunnel arbitrary TCP traffic through the compromised host.
“This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization’s internal network through the reverse tunnel. The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host,” Microsoft said.
Unlike previous ClickFix campaigns that typically delivered a single information stealer, TerminalFix uses a multi-stage attack chain combining social engineering, PowerShell, DLL sideloading, steganography, persistence, Active Directory reconnaissance, command execution, and network tunneling.