TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
TerminalFix is a new ClickFix variant that tricks users into running malicious PowerShell commands via fake Cloudflare CAPTCHA pages on compromised websites The attack chain uses DLL sideloading (rogue dui70.dll alongside legitimate LockScreenContentServer.exe) to execute a multi-stage intrusion A Python-based reverse-tunnel C2 implant establishes persistent encrypted WebSocket access, allowing attackers to proxy arbitrary TCP traffic and reach any host on the victim's internal network Extensive
Analysis
TL;DR
- TerminalFix is a new ClickFix variant that tricks users into running malicious PowerShell commands via fake Cloudflare CAPTCHA pages on compromised websites
- The attack chain uses DLL sideloading (rogue dui70.dll alongside legitimate LockScreenContentServer.exe) to execute a multi-stage intrusion
- A Python-based reverse-tunnel C2 implant establishes persistent encrypted WebSocket access, allowing attackers to proxy arbitrary TCP traffic and reach any host on the victim's internal network
- Extensive Active Directory reconnaissance is performed, including domain trust discovery, admin enumeration, and internal network topology mapping
- Microsoft warns the reverse-tunnel capability enables privilege escalation, security control disarmament, data exfiltration, and ransomware deployment
Why It Matters
TerminalFix represents an evolution in social engineering attacks by targeting Windows Terminal and PowerShell instead of the traditional Run dialog, significantly increasing the success rate of complex multi-line script execution. The reverse-tunnel implant architecture gives attackers persistent, network-level access that bypasses perimeter defenses, making it a critical threat for enterprise environments relying on standard network security perimeters.
Technical Details
- Delivery mechanism: Fake Cloudflare CAPTCHA pages served on compromised websites prompt users to copy and paste a PowerShell command into Windows Terminal or PowerShell, leveraging social engineering to bypass user caution
- DLL sideloading: A ZIP archive containing legitimate binary "LockScreenContentServer.exe" and malicious "dui70.dll" is downloaded; the rogue DLL is loaded by the legitimate executable, enabling payload execution without raising immediate suspicion
- Steganographic payload delivery: Next-stage payloads are hidden within PNG images hosted on domains like "bestsocialmedianewspapper[.]com" and "offlineupdater[.]com", retrieved by the sideloaded DLL
- Reverse-tunnel C2 implant: A custom Python-based backdoor ("client.py") creates an encrypted WebSocket tunnel to "gitnow[.]dev:443", allowing arbitrary TCP traffic proxying and enabling the C2 server to reach any internally visible host
- Persistence and monitoring: The implant establishes persistence via Registry Run keys and scheduled tasks, plus a persistent PowerShell file-watch loop that monitors for new commands, executes them via Invoke-Expression, and logs results
- Reconnaissance scope: System metadata collection, domain trust discovery, domain admin enumeration, Active Directory user/computer searches, and ICMP-based internal network topology mapping
Industry Insight
- Security teams should prioritize restricting PowerShell and Run dialog execution for standard users through AppLocker, Windows Application Control, or Group Policy, as these execution paths are the primary attack vector for ClickFix variants
- Network segmentation and monitoring of outbound WebSocket connections to unusual endpoints should be implemented, as the reverse-tunnel capability effectively turns compromised hosts into internal network proxies that bypass traditional perimeter defenses
- Employee security awareness training must specifically address CAPTCHA-based social engineering, as these attacks exploit legitimate-looking security prompts to manipulate users into executing arbitrary code
Disclaimer: The above content is generated by AI and is for reference only.