A sophisticated new ClickFix variant called TerminalFix is tricking users into executing malicious PowerShell commands via fake Cloudflare CAPTCHAs to establish reverse tunnels into internal networks.

  • Uses fake Cloudflare CAPTCHA prompts to trick victims into running PowerShell scripts.
  • Establishes a reverse tunnel, allowing attackers to pivot into internal corporate networks.
  • Employs steganography to hide malicious payloads within PNG image files.

Microsoft security researchers have sounded the alarm over a new threat actor campaign utilizing a variant of ClickFix known as TerminalFix. Unlike typical phishing attempts that aim for simple credential theft or infostealer deployment, TerminalFix is designed for deep network penetration. By manipulating users into interacting with the Windows Terminal, attackers can execute complex, multi-line scripts that would otherwise be blocked by standard browser security.

The attack vector begins with a compromised website displaying a fraudulent Cloudflare CAPTCHA. The prompt instructs the victim to copy a pre-loaded PowerShell command from their clipboard and run it in their terminal to "verify" their identity. This social engineering tactic effectively bypasses the browser's sandbox, granting the attacker direct execution privileges on the host machine.

Read Also:Spectre Attack on Cloudflare Workers Leaks Sensitive JWT Data

Why This Matters

BozokMedia analysis shows that the true danger of TerminalFix lies in its ability to transform a single infected endpoint into a strategic network pivot. Once the reverse tunnel is established, the attacker is no longer outside the firewall; they are effectively inside the perimeter. This allows for lateral movement toward high-value targets such as Domain Controllers, backup servers, and mail systems, significantly increasing the risk of a full-scale ransomware deployment.

"The use of reverse tunnels via WebSockets allows attackers to maintain a persistent, encrypted line of communication that often blends in with legitimate HTTPS traffic, making detection extremely difficult."

The technical execution of the malware is notably advanced. It utilizes steganography, a method of hiding data within other data. In this case, the threat actors hide executable fragments and DLLs within the pixel data of three PNG images. These images are downloaded from a command-and-control (C2) server and reassembled on the disk, successfully evading many signature-based detection tools.

The crown jewel of the attack is a custom Python reverse-tunnel module. This module connects to an external address (gitnow[.]dev:443) over an encrypted WebSocket, supporting SOCKS5-style TCP proxying. This capability enables the attacker to route traffic through the victim's machine to access internal IP addresses and hostnames that are not exposed to the public internet.

Did You Know?: Steganography comes from the Greek words 'steganos' (covered) and 'graphia' (writing), and it is now a primary tool for advanced persistent threats (APTs) to smuggle code past firewalls.

Frequently Asked Questions

Q1: How can I protect my organization from TerminalFix?
A: Restrict and log PowerShell execution, monitor for unauthorized instances of 'LockScreenContentServer.exe', and educate employees never to paste commands into a terminal from a web source.

Q2: What should be done if a compromise is detected?
A: Immediately rotate all administrative credentials, especially domain admin passwords, and conduct a thorough audit for lateral movement across the network.