A sophisticated new 'ClickFix' variant called TerminalFix is tricking corporate users into executing malicious PowerShell commands, creating dangerous reverse tunnels into secure internal networks.
- Attackers use fake Cloudflare CAPTCHAs to trick users into pasting malicious code into PowerShell.
- The campaign utilizes DLL sideloading and steganography (hiding payloads in PNG images) for stealth.
- A Python-based reverse-tunnel C2 implant allows attackers direct access to internal enterprise networks.
In a worrying escalation of social engineering tactics, a new cyber campaign dubbed 'TerminalFix' is targeting large-scale enterprises. This campaign is a sophisticated evolution of the 'ClickFix' model, where victims are lured to compromised websites and told that a technical glitch—such as a browser error or a failed CAPTCHA—can be fixed by executing a simple command in the Windows Terminal or PowerShell.
According to research from Microsoft, the attack begins with a deceptive overlay mimicking a Cloudflare CAPTCHA. To 'verify' their identity, users are instructed to copy a command (which is silently placed on their clipboard) and paste it into PowerShell. While many users view the terminal as a tool for IT professionals, modern Windows installations launch PowerShell by default, providing attackers with a powerful environment to execute complex, multi-line scripts that would fail in a standard 'Run' dialog.
The Anatomy of the Attack Chain
Once the initial command is executed, the infection follows a rigorous multistage process. First, it downloads a ZIP archive containing a malicious DLL designed for sideloading. To avoid detection by traditional antivirus software, the attackers employ steganography, concealing subsequent payloads within innocent-looking PNG images.
The campaign ensures long-term access by establishing dual persistence via Registry Run keys and scheduled tasks. The most critical phase involves the deployment of a Python-based reverse-tunnel Command and Control (C2) implant. This tool tunnels arbitrary TCP traffic through encrypted WebSocket channels, effectively bypassing firewalls and giving attackers a direct 'door' into the organization's internal network.
Why This Matters
BozokMedia analysis shows that the transition from simple infostealers to reverse-tunneling represents a strategic shift toward high-value corporate espionage and ransomware deployment. By establishing a foothold inside the network, threat actors can move laterally, escalate privileges, and disable security controls without triggering external perimeter alarms.
The combination of stealth techniques like DLL sideloading and persistent network access makes TerminalFix a critical threat to modern enterprise environments.
However, not all experts agree on the novelty of the 'TerminalFix' branding. Tommy Madjar, a senior threat researcher at Proofpoint, suggests that using terminal windows is not new and that this activity aligns with established clusters like ClearFake or ErrTraffic. He argues that the primary danger is not the tool used, but the human tendency to trust 'fix-it' instructions on a screen.
| Feature | Standard ClickFix | TerminalFix Variant |
|---|---|---|
| Execution Point | Windows Run / Terminal | Primarily PowerShell |
| Complexity | Simple Downloader | Multi-stage DLL Sideloading |
| Network Impact | Data Theft (Infostealer) | Reverse Tunneling (Full Access) |
Frequently Asked Questions
Q1: How can I tell if a CAPTCHA is fake?
Legitimate CAPTCHAs will never ask you to open a terminal, copy code, or run a PowerShell command to verify your identity.
Q2: Can disabling PowerShell stop these attacks?
While restricting PowerShell for standard users via Group Policy helps, the most effective defense is user education and blocking malicious domains at the DNS level.
