Microsoft Details TerminalFix Campaign Using Fake Cloudflare CAPTCHAs
Summary
Microsoft detailed TerminalFix, a ClickFix campaign that uses fake Cloudflare CAPTCHAs to trick Windows users into running PowerShell. Its reported chain includes DLL sideloading, PNG-hidden payloads, Active Directory reconnaissance and a persistent reverse-tunnel back
Key points
- Microsoft says compromised websites served fake Cloudflare CAPTCHA pages that prompt visitors to run malicious commands in Windows Terminal or PowerShell.
- The command downloads a ZIP containing a legitimate LockScreenContentServer.exe and rogue dui70.dll; the sideloaded DLL retrieves payloads hidden in PNG images from bestsocialmedianewspapper[.]com or offlineupdater[.]com.
- The reported malware establishes persistence through Registry Run keys and scheduled tasks, then performs Active Directory reconnaissance, including domain trust discovery and user and computer searches.
- A Python implant, client.py, uses an encrypted WebSocket reverse tunnel through gitnow[.]dev:443 to route TCP traffic to hosts visible from the infected machine.
- The attack also installs a persistent PowerShell file-watch loop that executes new commands and writes results to an output file.
- Microsoft says the access could enable further activity such as privilege escalation, disabling security controls, data exfiltration, or ransomware deployment.
- Recommended defenses include restricting PowerShell execution, monitoring for DLL sideloading, training users about ClickFix, and enabling PowerShell script block logging.
Article Details
- Attack Vectors
- Fake Cloudflare CAPTCHA pages on compromised websites prompt visitors to copy and execute a malicious command in Windows Terminal or PowerShell.
- The command downloads a ZIP archive containing LockScreenContentServer.exe and the rogue DLL dui70.dll, which is sideloaded to retrieve payloads hidden in PNG images.
- The implant establishes persistence with Registry Run keys and scheduled tasks, performs Active Directory and network reconnaissance, and tunnels TCP traffic through an encrypted WebSocket connection.
- A PowerShell file-watch loop monitors a text file for commands, executes them with Invoke-Expression, and writes results to an output file.
- Defensive Notes
- Restrict PowerShell and Run dialog execution for standard users using AppLocker, Application Control for Windows, or Group Policy.
- Consider blocking or auditing the Windows Run dialog if it is not required.
- Monitor for DLL sideloading indicators.
- Train employees to recognize ClickFix attacks.
- Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bestsocialmedianewspapper[.]com | External domain used to retrieve PNG images containing next-stage payloads. |
| DOMAIN | gitnow[.]dev | Attacker-controlled C2 infrastructure for the reverse-tunnel implant, communicating over port 443. |
| DOMAIN | offlineupdater[.]com | External domain used to retrieve PNG images containing next-stage payloads. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe malware pings named servers to map the internal network.T1027.003 · SteganographyNext-stage payloads are concealed inside PNG images.T1053.005 · Scheduled TaskThe malware establishes persistence using scheduled tasks.T1059.001 · PowerShellPowerShell downloads the archive, and a persistent PowerShell loop executes commands using Invoke-Expression.T1071.001 · Web ProtocolsThe implant communicates over an encrypted WebSocket channel.T1087.002 · Domain AccountThe reconnaissance phase enumerates domain administrators and searches Active Directory users.T1090.001 · Internal ProxyThe reverse tunnel lets the C2 server reach hosts visible from the infected machine's network.T1105 · Ingress Tool TransferThe PowerShell command downloads a ZIP archive, and the sideloaded DLL retrieves next-stage payloads from external domains.T1204.004 · Malicious Copy and PasteFake CAPTCHA pages trick users into copying and executing a malicious command.T1482 · Domain Trust DiscoveryThe reconnaissance phase performs domain trust discovery.T1547.001 · Registry Run Keys / Startup FolderThe malware establishes persistence using Registry Run keys.T1572 · Protocol TunnelingThe implant tunnels arbitrary TCP traffic through an encrypted WebSocket channel.T1574.002 · DLL Side-LoadingThe rogue dui70.dll is sideloaded alongside the legitimate LockScreenContentServer.exe binary.
People
Vendors
Products
Application Control for Windowsto restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy; consider blocking or auditing the Windows Run dialog (“Win+R”) if it’s notAppLockerthe threat, it’s advised to restrict PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy; consider blocking or auditing the Windows Run dialogPowerShellMicrosoft has detailed TerminalFix, a new ClickFix variant that tricks victims into running malicious commands in Windows Terminal or PowerShell through fake Cloudflare CAPTCHA pages on compromised websites.Windows TerminalMicrosoft has detailed TerminalFix, a new ClickFix variant that tricks victims into running malicious commands in Windows Terminal or PowerShell through fake Cloudflare CAPTCHA pages on compromised websites.