A sophisticated new attack campaign, dubbed TerminalFix, has been discovered by Microsoft, targeting users with fake Cloudflare CAPTCHA prompts on compromised websites. This insidious tactic tricks victims into executing malicious PowerShell commands in Windows Terminal, paving the way for a multi-stage intrusion chain that ultimately grants attackers a reverse tunnel into the victim’s internal network.
The infection process begins innocently enough, with a fake CAPTCHA prompt instructing users to execute a preloaded PowerShell command as part of the verification process. The command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory. This is where things take a turn for the worse, as the threat actor employs steganography to hide executables and DLL fragments in the pixel data of three PNG images.
These images are then downloaded from the command-and-control (C2) server and reassembled on the disk, establishing persistence through a scheduled task and a Registry Run key. The malware proceeds to perform reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory. This data is then fed into a custom Python reverse-tunnel module that connects to an outbound address (gitnow[.]dev:443) over an encrypted WebSocket.
This reverse tunnel is the most critical component of the TerminalFix campaign, allowing attackers to instruct compromised machines to connect to internal IPs, hostnames, and ports reachable from the victim. The tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown. In essence, this enables the attacker to turn the infected endpoint into a network pivot, granting access to systems discovered during the earlier AD and network reconnaissance operation.
Microsoft warns that if compromise is confirmed, it’s essential to investigate for lateral movement and rotate credentials, including domain admin credentials, if accessible from the infected host. The researchers also recommend restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its normal path, and hardening browsers and endpoint protections.
This campaign serves as a stark reminder of the evolving threat landscape and the importance of robust security measures. As attackers continue to adapt and innovate their tactics, it’s crucial for organizations and individuals alike to stay vigilant and proactive in defending against such threats. By staying informed and implementing best practices, we can mitigate the risk of falling victim to sophisticated attacks like TerminalFix.
Source: Bleeping Computer — 2026-08-31