- TerminalFix is a campaign that uses a fake Cloudflare Turnstile CAPTCHA to trick users into executing a malicious PowerShell command.
- The malicious PowerShell command copied to the clipboard downloads a ZIP archive, extracts it to a hidden directory under C:\ProgramData, and launches a batch file.
- The ZIP archive contains a legitimate signed executable named LockScreenContentServer.exe and a malicious DLL (dui70.dll), which is used for DLL sideloading.
- The malicious DLL uses steganography to download PNG images and extract hidden malware from their pixel data.
- TerminalFix establishes persistence through Registry Run keys and a scheduled task that relaunches the payload every 60 minutes.
- After gaining persistence, the malware performs reconnaissance by enumerating Active Directory users, computers, and domain admins.
- The custom reverse-tunnel implant runs via pythonw.exe, connecting to a WebSocket tunnel and providing SOCKS-style proxy access.
- Microsoft has warned of lateral movement and credential exposure risks associated with the TerminalFix campaign.
TerminalFix is a sophisticated cyberattack that begins on compromised websites, displaying a convincing Turnstile CAPTCHA to trick users into executing a malicious PowerShell command. This command downloads a ZIP archive containing a legitimate executable and a malicious DLL, which is sideloaded to initiate further infection stages.12345678
The malware employs steganography to hide its payloads within PNG images, complicating network inspections. Once installed, it establishes persistence through Registry Run keys and scheduled tasks, relaunching the malicious executable every 60 minutes. The malware conducts extensive reconnaissance, gathering system information and identifying critical internal systems.91011
The most concerning aspect of TerminalFix is its custom reverse-tunnel implant, which connects to external servers and allows attackers to relay TCP traffic, effectively granting them SOCKS-style proxy access to the corporate network. This capability transforms the infected device into a pivot point for accessing internal systems that are otherwise unreachable from the internet.
Microsoft has cautioned organizations to investigate affected devices for potential lateral movement and credential exposure, although they did not observe any follow-on actions in the analyzed attack chain. The campaign combines social engineering, DLL sideloading, and advanced tunneling techniques, posing a significant threat to various industries.14
“The attack chain abuses DLL sideloading with a legitimate signed executable and a malicious DLL, then hides payloads in PNG images via steganography. Microsoft observed no follow-on actions but advises treating any infection as potential network-level access, not just a cleanup event.”
cyberpress.org
CyberSecurityNews
