TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor via Fake Cloudflare CAPTCHAs

TerminalFix is a ClickFix variant that Microsoft disclosed in an analysis attributed to researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan. Traditional ClickFix lures push victims to the Windows Run dialog, but TerminalFix instead directs them to Windows Terminal or PowerShell, which Microsoft says increases the odds that longer, multi-line scripts execute without errors.

The campaign targets organizations across multiple sectors and starts on compromised websites. Visitors are shown a fake Cloudflare CAPTCHA verification screen instructing them to copy a command and paste it into a terminal window, a classic social-engineering pretext that mimics a routine "prove you're human" check.

Once executed, the PowerShell command downloads a ZIP archive containing a legitimate binary, "LockScreenContentServer.exe," alongside a malicious DLL named "dui70.dll," a pairing designed to trigger DLL sideloading when the legitimate executable is launched. Per Microsoft, the sideloaded DLL then fetches next-stage payloads that are hidden using steganography inside PNG images retrieved from external domains including "bestsocialmedianewspapper[.]com" and "offlineupdater[.]com".

This layering of a signed executable, a rogue DLL, and image-embedded payloads is intended to evade static detection tools that inspect files individually rather than the full execution chain. Persistence is set through both Registry Run keys and scheduled tasks, giving the malware two independent ways to survive a reboot.

The final payload is a Python-based command-and-control implant Microsoft names "client.py," which tunnels arbitrary TCP traffic to attacker infrastructure at "gitnow[.]dev:443" over an encrypted WebSocket channel. Microsoft describes this as a bespoke reverse-tunnel implant that grants attackers persistent, network-level proxy access through the infected machine, meaning the C2 server can reach any host visible from the victim's internal network, not just the compromised endpoint itself.

Microsoft says the campaign targets organizations across multiple sectors, with no single industry singled out in the disclosed analysis. Any employee who visits a compromised website and follows the fake CAPTCHA prompt to run PowerShell in Windows Terminal is a potential entry point, regardless of the organization's size.

Because the attack relies on tricking a human into pasting and running a command rather than exploiting a software flaw, standard patching does not address the root risk. Endpoint controls that govern who can run PowerShell or the Run dialog become the primary line of defense.

• Collects system metadata from the infected host.
• Performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches.
• Pings named servers to map the internal network topology.
• Deploys a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file.

This reconnaissance phase, combined with the reverse tunnel, effectively hands the attacker a remote console into Active Directory before any lateral movement occurs, according to Microsoft's analysis.

• Restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy.
• Consider blocking or auditing the Windows Run dialog (Win+R) if it is not required for normal business use.
• Monitor for DLL sideloading indicators, such as unexpected DLLs loaded alongside signed binaries like LockScreenContentServer.exe.
• Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands.
• Train employees to recognize ClickFix-style prompts that ask them to copy and paste commands into a terminal.

Microsoft's guidance frames these controls as complementary: technical restrictions reduce the chance a pasted command ever runs, while logging and monitoring catch the sideloading and reconnaissance activity if a user does execute it.

TerminalFix's reverse-tunnel implant gives attackers persistent, network-level proxy access from a single compromised endpoint, opening the door to lateral movement and ransomware deployment.

Security: Once installed, the backdoor lets attackers reach any host visible from the victim's network, enabling privilege escalation, security control tampering, and further reconnaissance beyond the initial foothold.

Microsoft disclosed TerminalFix, a ClickFix variant that uses fake Cloudflare CAPTCHA pages to push victims into running PowerShell that ultimately installs a Python reverse-tunnel backdoor.