Microsoft has published a detailed analysis of the new TerminalFix campaign, a variant of the ClickFix technique targeting organizations across multiple industries. Unlike classic ClickFix attacks, which direct the victim to the Run dialog (Win+R), TerminalFix redirects users to Windows Terminal or PowerShell, which makes it possible to run complex multi-line scripts. The attack chain includes DLL sideloading, extracting the payload from images via steganography, Active Directory reconnaissance, and deployment of a custom reverse tunnel that turns the compromised machine into an entry point into the internal network. Organizations should immediately restrict PowerShell execution for standard users and enable script block logging.
Initial vector: fake CAPTCHA on compromised sites
The attack begins with the compromise of legitimate websites, where a fake Cloudflare CAPTCHA verification is hosted. The visitor is prompted to copy and execute a PowerShell command—supposedly to complete the verification. The key difference from traditional ClickFix campaigns is that the user is directed specifically to Windows Terminal or PowerShell, not to the Run dialog. As Microsoft researchers Sagar Patil, Suryaraj Natarajan, and Parasharan Raghavan note, this significantly increases the likelihood of successfully executing complex multi-stage scripts.
Multi-stage infection chain
DLL sideloading via a legitimate binary
The executed PowerShell command downloads a ZIP archive containing two files: a signed legitimate binary LockScreenContentServer.exe and a malicious library dui70.dll. When the legitimate executable is launched, it loads the malicious DLL—a classic DLL sideloading technique (MITRE ATT&CK T1574.002), which allows the attackers to bypass defenses because the main process is trusted.
Steganography and persistence
The downloaded malicious DLL extracts the next-stage payload from PNG images hosted on external domains. The data is reconstructed from the pixel data of the images—a steganography technique (T1027.003) that makes detection by network security tools more difficult. To ensure persistence, the malware uses two mechanisms simultaneously: Run keys in the registry (T1547.001) and scheduled tasks (T1053.005).
Active Directory reconnaissance
After persistence is established, the malware performs extensive reconnaissance of the internal environment:
- Collecting system metadata
- Discovering trust relationships between domains
- Enumerating domain administrators
- Searching for users and computers in Active Directory
- Pinging named servers to map the internal network topology
Taken together, these activities map to several MITRE ATT&CK techniques: T1482 (discovery of domain trust relationships), T1069.002 (domain group enumeration), T1087.002 (domain account enumeration), T1018 (remote system discovery).
Reverse tunnel and control
The final stage is the deployment of a Python-based implant (client.py) that establishes an encrypted reverse tunnel over WebSocket to a command server. The implant can proxy arbitrary TCP traffic, effectively turning the compromised machine into a network gateway: the command server gains the ability to reach any host accessible from the victim’s network. Additionally, a persistent PowerShell monitoring loop is deployed, which monitors a text file for new commands, executes them via Invoke-Expression, and writes the results to an output file.
Indicators of compromise
In the course of its analysis, Microsoft identified the following malicious domains:
- bestsocialmedianewspapper[.]com — hosts PNG images carrying steganographic payloads
- offlineupdater[.]com — alternative payload hosting
- gitnow[.]dev (port 443) — command server for the reverse tunnel
Impact assessment
The campaign poses a high risk to corporate environments. The reverse tunnel grants the attacker direct access to the organization’s internal network, and the results of Active Directory reconnaissance provide information for further movement. Microsoft emphasizes that such access could potentially be used for privilege escalation, disabling security controls, data theft, and ransomware deployment; however, these actions were not observed in the analyzed attack chain—they are mentioned as possible scenarios for further exploitation.
Mitigation recommendations
To reduce the risks associated with TerminalFix, it is recommended to:
- Restrict PowerShell execution for standard users via AppLocker, Windows Defender Application Control, or Group Policy
- Block or set to audit the Run dialog (Win+R) if it is not required for business processes
- Enable PowerShell Script Block Logging to detect obfuscated and encoded commands
- Monitor for signs of DLL sideloading: execution of LockScreenContentServer.exe from non-standard paths, loading of dui70.dll from directories other than system ones
- Train employees to recognize fake CAPTCHAs that require copying and pasting commands
- Investigate compromised hosts as potential entry points into the network—check for reverse tunnels and traces of Active Directory reconnaissance
Organizations that detect connections to the specified domains or execution of LockScreenContentServer.exe from atypical locations should immediately isolate affected hosts, analyze network traffic for WebSocket connections to gitnow[.]dev:443, and audit Active Directory accounts that the attacker could have accessed via the reconnaissance mechanism. The priority is to restrict PowerShell execution for non-privileged users, as this action breaks the attack chain at the earliest stage.
