Attackers are deploying fraudulent CAPTCHA verification screens that deceive users into executing harmful PowerShell scripts, ultimately establishing encrypted reverse tunnels into compromised corporate networks, according to Microsoft Threat Intelligence. The operation, which Microsoft labels TerminalFix, represents an evolution of the ClickFix method and leverages hijacked websites to present fake Cloudflare security checks. Once victims follow the instructions and run the supplied command, they initiate a multi-phase intrusion involving DLL sideloading, concealed payloads, system persistence, Active Directory reconnaissance, and a custom Python-based tunneling implant.
The assault begins when compromised sites display a bogus Cloudflare CAPTCHA overlay instructing visitors to copy and execute a PowerShell command rather than simply checking a box. That command retrieves a ZIP file holding a legitimate Windows executable called LockScreenContentServer.exe paired with a malicious library named dui70.dll, which are then used for DLL sideloading, a tactic where genuine software loads a harmful component. The sideloaded DLL pulls down additional payloads hidden inside PNG image files through steganography and creates persistence via Registry Run entries and scheduled tasks, giving the malware multiple survival mechanisms. The intrusion then shifts to reconnaissance, with the malware listing domain trusts, hunting for domain administrators, extracting Active Directory user descriptions, and running targeted ping sweeps to map reachable systems. The final payload is a reverse-tunnel implant built in Python that downloads a Python runtime and tunneling client, then uses pythonw.exe to launch without a visible window and establishes an encrypted WebSocket link to attacker infrastructure.
Microsoft noted that "traditional ClickFix campaigns direct victims to the Windows Run dialog," but "TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully." The company emphasized that the reconnaissance work and reverse-tunnel capability could enable an operator to identify and reach more systems from the breached host. Microsoft stressed that it did not observe the downstream actions that could follow in the analyzed campaign, though the access obtained could provide the foundation for lateral movement, privilege escalation, data theft, or other follow-on activity.
The significance of TerminalFix lies in its transformation of a single compromised endpoint into a gateway for broader network intrusion. Rather than simply maintaining control over one machine, the attacker gains full SOCKS-style TCP proxy access through the infected host, effectively converting it into a bridge that can route connections to internal systems. The technique's reliance on social engineering through familiar security prompts makes it particularly effective, as users have grown accustomed to CAPTCHA verifications as routine security measures. Microsoft recommended that organizations thoroughly investigate affected hosts and hunt for unusual execution of LockScreenContentServer.exe from non-standard paths, suspicious PowerShell activity, hidden payload directories, and unusual outbound connections associated with the campaign. The company has also released detection coverage, indicators of compromise, hunting queries, and mitigation guidance for the observed activities. Organizations that rely on endpoint detection alone may find themselves vulnerable, since the attack exploits user behavior rather than software flaws, turning legitimate trust in security interfaces into an entry point for sustained network access. The shift from simple one-click exploits to terminal-based script execution also suggests attackers are refining their methods to bypass user awareness training that focuses on avoiding suspicious downloads or links.