TerminalFix ClickFix Variant Hides Reverse-Tunnel Backdoor Behind Fake Captchas

Microsoft has shed light on a sophisticated new ClickFix variant dubbed TerminalFix that tricks users into running malicious PowerShell commands through fake Cloudflare CAPTCHA verification pages. Unlike traditional ClickFix campaigns that direct victims to the Windows Run dialog, TerminalFix steers users toward Windows Terminal or PowerShell itself — a subtle shift that makes complex, multi-line scripts far more likely to execute successfully. Researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan described the campaign as targeting organizations across multiple sectors, using compromised websites as launch pads to deliver the convincing social-engineering lures.

The attack chain is a multi-stage affair. Visitors who follow the fake CAPTCHA instructions end up copying and executing a PowerShell command that pulls down a ZIP archive containing a legitimate Microsoft binary ("LockScreenContentServer.exe") alongside a rogue DLL ("dui70.dll"). This sets up a classic DLL sideloading attack, where the malicious DLL reaches out to domains such as bestsocialmedianewspapper[.]com or offlineupdater[.]com to fetch next-stage payloads steganographically embedded inside PNG images. Once active, the implant establishes persistence via both Registry Run keys and scheduled tasks, then performs extensive Active Directory reconnaissance — collecting system metadata, mapping domain trusts, enumerating domain admins, and pinging named servers to chart the internal network topology. Security teams investigating the staging infrastructure can run a WHOIS lookup on these domains to map registrant patterns and uncover related registrations.

The crown jewel is a Python-based reverse-tunnel implant named "client.py" that tunnels arbitrary TCP traffic back to attacker-controlled infrastructure at gitnow[.]dev:443 through an encrypted WebSocket channel. Because the tunnel operates at the network level, the C2 server can reach any host visible from the victim's network, effectively turning the compromised machine into a proxy pivot. Defenders can probe suspicious gateway endpoints with a port scanner to detect unusual listeners, or use an SSL/TLS checker to inspect the certificate behind the encrypted WebSocket channel. A persistent PowerShell file-watch loop also monitors a local text file for new commands and executes them via Invoke-Expression, giving operators an interactive foothold even after the initial payload finishes.

Microsoft warned that this style of intrusion is particularly dangerous because it grants attackers direct access to the internal network through the reverse tunnel, enabling privilege escalation, the disabling of security controls, sensitive data exfiltration, and ultimately ransomware deployment. The combination of living-off-the-land tradecraft, DLL sideloading, steganographic payload delivery, and a custom Python backdoor makes TerminalFix a serious, enterprise-grade threat that blue teams should be actively hunting for in their environments.