TerminalFix Campaign Uses Fake CAPTCHAs to Tunnel Into Enterprise Networks

A sophisticated social engineering campaign dubbed "TerminalFix" is targeting enterprise users by tricking them into executing malicious PowerShell commands through fake Cloudflare CAPTCHA overlays. By leveraging a variant of the "ClickFix" attack pattern, the campaign establishes a persistent foothold in corporate environments to grant attackers direct access to internal networks.

The attack begins when a victim encounters a fraudulent CAPTCHA prompt that instructs them to paste a pre-copied command into Windows Terminal or PowerShell. Once executed, this initial command downloads a zip archive containing a malicious DLL—specifically LockScreenContentServer.exe and dui70.dll—which are used for DLL sideloading. To maintain stealth, the attackers employ steganography to conceal their payloads. Persistence is ensured through a combination of Registry Run keys and scheduled tasks that relaunch the executable every 60 minutes.

The Evolution of ClickFix

This campaign represents an escalation of the "ClickFix" methodology. While traditional ClickFix attacks typically use the Windows Run dialog to deploy simple downloaders, TerminalFix utilizes the full capabilities of PowerShell. Microsoft notes that directing users toward PowerShell increases the likelihood of success when deploying the longer, more complex scripts required for enterprise-grade intrusions.

Bypassing the Perimeter

The most critical component of the TerminalFix chain is the deployment of a Python-based reverse-tunnel C2 implant, identified as client.py. This implant tunnels TCP traffic via encrypted WebSockets, effectively creating a bridge from the internal network to the attacker's infrastructure.

Because this reverse tunnel originates from inside the network, it bypasses traditional perimeter defenses. This provides attackers with "hands-on-keyboard" access, allowing them to escalate privileges, disable security controls, and exfiltrate sensitive data or deploy ransomware across an organization with high stealth. Microsoft researchers noted that the combination of steganography, DLL sideloading, and persistent network access makes the campaign a serious threat to enterprise environments.

Defensive Outlook

Security professionals are urged to prioritize user education and technical blocks to mitigate the risk. Tommy Madjar, a senior threat researcher at Proofpoint, states that defenses should focus on training users not to execute commands copied from untrusted websites and blocking malicious sites before users reach them. For organizations where prevention fails, the priority shifts to detecting suspicious execution patterns within PowerShell and monitoring for unauthorized encrypted WebSocket traffic.