- TerminalFix, a new cyberattack variant, uses fake CAPTCHA pages to trick users into installing backdoor malware.
- This attack is a variant of ClickFix, which previously targeted the Windows Run dialogue box.
- In TerminalFix, victims are directed to run commands through Windows Terminal or PowerShell, allowing for more complex command execution.
- The malware downloads a ZIP archive containing a legitimate signed executable and a malicious DLL, which decodes payloads in memory.
- TerminalFix employs steganography to conceal malicious components within PNG images.
- The malware establishes persistence through a scheduled task and a Registry Run key, executing every hour.
- After establishing persistence, the malware scans the network for high-value targets such as domain controllers and database servers.
- A custom Python reverse-tunnel module allows attackers to gain network-level proxy access through the compromised host.
- Microsoft has issued recommendations for organizations to limit PowerShell and Run dialogue usage and monitor for DLL sideloading.
Microsoft has uncovered a new cyberattack called TerminalFix, which utilizes fake CAPTCHA pages to trick users into executing malicious commands via Windows Terminal and PowerShell. This attack is a variant of the older ClickFix method, now designed to provide attackers with persistent access to compromised systems.123
The attack begins on compromised websites that display fake Cloudflare CAPTCHA verification pages, prompting users to run a command that downloads a ZIP archive containing both a legitimate executable and a malicious DLL. The DLL decodes an obfuscated payload, establishing a foothold on the system.4
Microsoft warns that this type of access is particularly dangerous, as it allows attackers to potentially escalate their privileges, disable security tools, and exfiltrate sensitive data. The malware includes a monitoring system that checks for new instructions from the attacker, making it more persistent and difficult to remove.
To mitigate risks, Microsoft recommends organizations restrict and log PowerShell execution, monitor for signs of DLL sideloading, and train staff to recognize fake CAPTCHA scams. Additionally, they advise turning on PowerShell script block logging to detect suspicious commands before they cause harm.
TerminalFix also employs steganography to conceal malicious components, downloading hidden executable fragments within PNG images. The malware establishes persistence through scheduled tasks and Registry Run keys, executing every hour to examine the victim's network for valuable data and systems.56
Microsoft emphasizes that organizations confirming an infection should investigate for signs of lateral movement and rotate potentially exposed credentials, including domain administrator credentials.
“TerminalFix is a ClickFix variant that uses steganography to hide malicious code in PNG images, establishing persistence via scheduled tasks and Registry Run keys. The malware can turn a compromised PC into a pivot point for lateral movement, privilege escalation, and ransomware deployment.”
