Microsoft has sounded the alarm on a sophisticated cyber attack campaign that uses fake Cloudflare CAPTCHA prompts to trick victims into executing malicious PowerShell commands in Windows Terminal. Dubbed “TerminalFix,” this variant of the ClickFix malware family is notable for its multi-stage intrusion chain, which ultimately gives attackers a reverse tunnel into the victim’s internal network.
The infection begins with a convincing CAPTCHA prompt that instructs users to execute a PowerShell command preloaded into their clipboard as part of the verification process. The command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory. This initial stage sets the stage for the second phase of the attack.
In this stage, the threat actor uses steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads the image files from a command-and-control (C2) server and reassembles the embedded payloads on the disk. This clever technique allows the attackers to bypass traditional security measures and evade detection.
The malware then establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour. While active, it performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory (AD). The most significant component of the malware is a custom Python reverse-tunnel module that connects to an outbound address over an encrypted WebSocket.
This reverse tunnel allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim. The tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown. Microsoft warns that this can turn the infected endpoint into a network pivot, giving the attacker a route to systems discovered during the earlier AD and network reconnaissance operation.
To mitigate the risk of TerminalFix attacks, Microsoft recommends restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its normal path, and hardening browsers and endpoint protections. If compromise is confirmed, it is advisable to investigate for lateral movement and to rotate credentials, including domain admin credentials, if accessible from the infected host.
The fact that attackers can use valid credentials to bypass traditional security measures highlights the importance of prioritizing prevention after initial access has been gained. According to The Blue Report 2026, once attackers have valid credentials, only 37% of their actions are blocked. This underscores the need for organizations to stay vigilant and monitor their networks for signs of lateral movement, even if initial defenses appear to be effective.
To protect yourself from TerminalFix attacks, it’s essential to remain cautious when interacting with CAPTCHA prompts on compromised websites. Avoid executing PowerShell commands or downloading files from unfamiliar sources. Regularly update your operating system, browser, and security software to ensure you have the latest protections in place. By staying informed and taking proactive steps to secure your network, you can reduce the risk of falling victim to this sophisticated cyber attack campaign.
Source: Bleeping Computer — 2026-08-31