Kiran 
Microsoft Threat Intelligence has uncovered a dangerous new social-engineering campaign called TerminalFix, a more aggressive evolution of the ClickFix technique that tricks victims into running malicious code themselves, this time through Windows Terminal or PowerShell rather than the Run dialog.
The shift matters because Terminal windows can execute long, multi-line scripts far more reliably than the Run box, allowing attackers to pack a far more complex intrusion chain.
The attack starts on a compromised website that briefly loads normally before being overlaid with a convincing fake Cloudflare Turnstile “Verify you are human” prompt.
TerminalFix ClickFix Attack Uses Fake CAPTCHA
When a victim clicks it, a malicious PowerShell command is silently copied to their clipboard, and on-screen instructions coax them into pasting it directly into Terminal. The script prints reassuring, color-coded “verification” messages while quietly downloading a ZIP archive to C:\ProgramData and launching it in the background.
Rather than dropping an obvious malicious executable, the campaign abuses a legitimate, signed Windows binary called LockScreenContentServer.exe, which normally loads a file named dui70.dll.
Attackers plant a forged version of that DLL in the same folder, exploiting how Windows resolves library paths a classic DLL sideloading technique that lets the malware execute inside a trusted process. From there, things get unusually creative.
The sideloaded DLL launches PowerShell to fetch PNG image files from attacker-controlled domains and extract hidden executable code embedded in the pixel data a steganographic trick that splits a malicious DLL across two separate images to complicate detection. The source images are deleted afterward to limit forensic evidence.
Once persistence is locked in via registry Run keys and a scheduled task that fires every 60 minutes, the malware conducts extensive reconnaissance: mapping Active Directory trusts, hunting for domain admin accounts, harvesting user descriptions, and ping-sweeping servers with names suggestive of domain controllers, databases, and backup systems.
Scripts even include English, Spanish, and German locale checks, hinting at a campaign built for international targets.
The most consequential piece is a custom Python-based implant. Using an unmodified, signed Python runtime pulled straight from python.org, the attacker’s own client.py script establishes an outbound TLS WebSocket connection to a command server at gitnow[.]dev on port 443.
This creates a SOCKS5-style tunnel that lets the attacker route arbitrary TCP traffic through the compromised machine and reach any internal system, turning one infected laptop into a launchpad for the rest of the network. Running invisibly via pythonw.exe, the tunnel blends into ordinary encrypted web traffic.
“TerminalFix shows how attackers are weaponizing the same trust signals a familiar CAPTCHA, a signed binary, an official Python runtime that defenders are trained to overlook. The danger isn’t the malware’s sophistication alone; it’s that every stage borrows legitimacy from something real.”
Microsoft recommends restricting PowerShell execution for standard users, auditing or disabling the Run dialog, enabling script block logging, and hunting for LockScreenContentServer.exe running from non-standard directories.
Because the reverse tunnel grants direct network access, any organization finding these indicators should treat the host as a confirmed pivot point, rotate exposed credentials, especially domain admin accounts, and actively hunt for lateral movement before attackers move into the ransomware deployment phase that typically follows this kind of access.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
