TerminalFix Campaign Uses Fake Cloudflare

Microsoft has disclosed a new variant of the ClickFix malware, named TerminalFix. The campaign tricks users into running malicious commands in Windows Terminal or PowerShell to deploy a sophisticated backdoor.

According to Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan, TerminalFix applies the same technique as traditional campaigns but directs users to terminal environments. This increases the chance that complex, multi-line scripts will execute successfully. The campaign targets organizations across multiple sectors.

Attack Chain and Initial Infection

The attack starts on compromised websites. These sites serve fake Cloudflare CAPTCHA verification pages. Unsuspecting visitors are prompted to copy and execute a malicious PowerShell command.

That command downloads a ZIP archive. The archive contains a legitimate binary called LockScreenContentServer.exe and a rogue DLL named dui70.dll. This initiates a DLL sideloading attack.

Payload Delivery and Persistence

The sideloaded DLL retrieves next-stage payloads. These payloads are hidden within PNG images hosted on external domains, specifically bestsocialmedianewspapper[.]com or offlineupdater[.]com. The DLL also establishes persistence using both Registry Run keys and scheduled tasks.

A reconnaissance phase follows. It collects system metadata. It performs domain trust discovery and domain admin enumeration. It searches Active Directory for users and computers. It also pings named servers to map the internal network topology.

The attack delivers a persistent PowerShell file-watch loop. This loop monitors a text file for new commands, executes them via Invoke-Expression, and writes the results to an output file.

Reverse-Tunnel Backdoor Capabilities

The final payload is a Python-based reverse-tunnel command-and-control implant called client.py. This backdoor is equipped to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure at gitnow[.]dev:443. It uses an encrypted WebSocket channel.

The implant enables the C2 server to reach any host visible from the victim's network. Microsoft stated this type of intrusion is particularly dangerous. It provides attackers with direct access to an organization's internal network through the reverse tunnel.

The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host. Microsoft warned that such access can be abused to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware. This makes TerminalFix a serious threat to enterprise environments.

Mitigation and Detection Advice

Microsoft provided several mitigation strategies. To restrict execution, use AppLocker, Application Control for Windows, or Group Policy for standard users. Consider blocking or auditing the Windows Run dialog (Win+R) if it is not required. Organizations should monitor for DLL sideloading indicators.

Employee training is advised to help spot ClickFix attacks. Enabling PowerShell script block logging can help detect and analyze obfuscated or encoded commands. These steps are critical for defending against this sophisticated multi-stage process that leverages steganography and custom implants.