TerminalFix Attack Uses Fake CAPTCHAs and Steganography to Drop Reverse Tunnels on Corporate Networks

Cybersecurity researchers have uncovered a multi-stage attack campaign that uses deceptive verification prompts to trick enterprise employees into executing malicious scripts on Windows machines. The technique, identified as a variant of the ClickFix social engineering method called TerminalFix, hides payload components inside image files and ultimately installs a persistent reverse tunnel on compromised networks, as first reported by technology news site The Register.

Unlike traditional ClickFix campaigns that direct targets toward the standard Windows Run dialog, TerminalFix instructs users to open Windows PowerShell or Windows Terminal. The intrusion begins when a victim encounters a malicious website overlay impersonating a Cloudflare human verification check. Interacting with the fake prompt automatically copies a malicious command to the user's clipboard, alongside instructions to paste and run the text directly in their command-line interface.

Executing the pasted snippet runs a hidden PowerShell script that prints a fake verification message while silently downloading a ZIP archive into the machine's C:\ProgramData directory. The script then launches a batch file that executes LockScreenContentServer.exe, a legitimate and digitally signed Windows binary. Attackers exploit that binary through DLL sideloading to execute a malicious payload named dui70.dll, which disguises itself as the Windows DirectUI Engine.

Once sideloaded, the malicious DLL executes a second PowerShell script that downloads three separate PNG image files to retrieve additional malware components without triggering standard file-inspection filters. The script extracts an executable file from the first image and two halves of a DLL from the remaining two images before assembling the components on disk. Microsoft security analysts Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan noted that the source PNG images are immediately erased following extraction to diminish forensic evidence.

The malware secures persistence through Windows registry keys and scheduled tasks configured to re-launch LockScreenContentServer.exe every 60 minutes. It then conducts automated system reconnaissance across English, Spanish, and German language configurations. The script performs domain trust discovery, enumerates domain administrative accounts, searches Active Directory users and assets, and pings designated servers tied to critical infrastructure roles such as domain controllers, databases, gateways, backup repositories, and email servers.

To maintain remote control over the compromised host, the malware deploys a local file-monitoring loop that watches a text document for incoming commands, executes them via PowerShell's Invoke-Expression function, and writes command output to a separate text file. In the final stage, the attack launches a hidden, Python-based reverse-tunnel tool using pythonw.exe. The implant establishes a WebSocket connection to gitnow[.]dev over port 443, providing the attacker with SOCKS-style proxy access into the target network.

Microsoft declined to provide details on the number of impacted organizations or the identity of the threat group responsible for the campaign, according to reporting by The Register. The tech giant recommended that network administrators restrict PowerShell execution, restrict or audit the Windows Run dialog shortcut, and educate corporate personnel on identifying deceptive CAPTCHA prompts that instruct users to run terminal commands.