Microsoft Details TerminalFix ClickFix Attacks Using Reverse Tunnels
Summary
Microsoft details TerminalFix, a ClickFix campaign using fake Cloudflare CAPTCHA prompts to run PowerShell, deploy in-memory payloads, persist, conduct reconnaissance and provide a Python reverse tunnel. Microsoft saw no hands-on activity.
Key points
- Fake Cloudflare CAPTCHA prompts on compromised sites trick victims into running clipboard-loaded PowerShell commands in Windows Terminal.
- The command downloads a ZIP containing a signed executable and malicious DLL that launches an obfuscated payload in memory.
- A script retrieves three PNG images from a C2 server and reconstructs hidden executable and DLL fragments from their pixel data.
- The malware uses a scheduled task and Registry Run key for hourly persistence, then probes for internal systems and enumerates Active Directory.
- A custom Python module connects to gitnow[.]dev:443 over an encrypted WebSocket, providing SOCKS5-style TCP proxying into reachable internal systems.
- Microsoft says it found the attacks in the wild but observed no hands-on activity; credential theft and ransomware deployment are potential follow-on actions, not observed outcomes.
- Microsoft recommends restricting and logging PowerShell, monitoring LockScreenContentServer.exe outside its normal path, and investigating lateral movement and rotating accessible credentials after confirmed compromise.
Article Details
- Attack Vectors
- Fake Cloudflare CAPTCHA prompts on compromised websites instruct victims to run a PowerShell command preloaded in the clipboard.
- The command downloads a ZIP archive containing a signed executable and a malicious DLL; the DLL decodes and launches an obfuscated payload in memory.
- A script downloads three PNG images from a C2 server and reconstructs executables and DLL fragments hidden in their pixel data.
- The malware establishes persistence with a scheduled task and a Registry Run key configured to execute hourly.
- The malware performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems, collecting system information, and enumerating Active Directory.
- A custom Python reverse tunnel uses an encrypted WebSocket and SOCKS5-style TCP proxying to connect the compromised host to internal systems.
- Defensive Notes
- Restrict and log PowerShell execution.
- Monitor LockScreenContentServer.exe when it appears outside its normal path.
- Harden browsers and endpoint protections.
- If compromise is confirmed, investigate for lateral movement and rotate credentials, including domain administrator credentials if they were accessible from the infected host.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gitnow[.]dev | Reported outbound reverse-tunnel address used for encrypted WebSocket connections. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe malware probes for domain controllers and other internal systems during reconnaissance.T1027.003 · SteganographyExecutables and DLL fragments are hidden in the pixel data of three PNG images.T1053.005 · Scheduled TaskA scheduled task configured to run hourly is used for persistence.T1059.001 · PowerShellThe attack uses PowerShell commands to download and run components.T1071.001 · Web ProtocolsThe reverse tunnel communicates over an encrypted WebSocket.T1082 · System Information DiscoveryThe malware collects system information.T1090.001 · Internal ProxyThe reverse tunnel proxies connections from the compromised host to internal systems reachable from the victim network.T1105 · Ingress Tool TransferThe script downloads a ZIP archive and PNG files from the C2 server.T1140 · Deobfuscate/Decode Files or InformationA malicious DLL decodes an obfuscated payload before launching it in memory.T1204.004 · Malicious Copy and PasteVictims are instructed to paste and execute a malicious command preloaded in the clipboard.T1547.001 · Registry Run Keys / Startup FolderA Registry Run key configured to execute hourly is used for persistence.
Products
PowerShellTerminalFix is a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised sites to trick victims into running malicious PowerShell commands in Windows Terminal.Windows TerminalTerminalFix is a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised sites to trick victims into running malicious PowerShell commands in Windows Terminal.