Hackers Exploit Fake Cloudflare CAPTCHA in New TerminalFix Campaign
A recent report highlights a concerning cybersecurity threat known as the TerminalFix campaign, which employs counterfeit Cloudflare CAPTCHA prompts to deceive users into executing malicious PowerShell commands. This nefarious strategy transforms compromised Windows devices into reverse-tunnel pivot points for attackers, enabling them to manipulate these devices for malicious purposes.
According to Microsoft, the TerminalFix campaign specifically targets organizations via compromised websites that substitute legitimate content with deceptive Cloudflare Turnstile-style overlays asking users to "Verify you are human." This sophisticated tactic bypasses direct exploitation of browser vulnerabilities, instead relying on social engineering techniques to convince unsuspecting victims to voluntarily copy and execute harmful commands that were originally provided by the attackers.
A Deceptive Technique
The methodology employed in this campaign is a variation of ClickFix, an increasingly popular social engineering tactic where victims are misled into executing commands to resolve fabricated browser errors, CAPTCHAs, or security warnings. Microsoft has designated this particular variant as TerminalFix due to its novel approach of shifting the execution process from the familiar Windows Run dialog to the more advanced interfaces of Windows Terminal or PowerShell.
Once a victim interacts with the fraudulent CAPTCHA, the malicious website automatically copies a harmful command to the clipboard. The victim is then prompted to open either Windows Terminal or PowerShell and paste the copied command. This seemingly harmless action inadvertently commences a series of automated processes that can compromise the user’s system.
The Malicious Payload
Following the execution of the fake command, the command triggers the download of a ZIP archive containing malicious files. This archive’s content is extracted into a concealed directory located under ProgramData, after which a batch file initiates background processes. The contents of this archive include a legitimate Microsoft-signed binary known as LockScreenContentServer.exe and a malicious dynamic-link library named dui70.dll.
Leveraging a technique known as DLL sideloading, the attackers position the malicious DLL within the application’s directory. As a result, the trusted Windows binary inadvertently loads and executes the harmful code contained within. This DLL is engineered to decode an obfuscated resource in memory, subsequently launching a second-stage PowerShell payload.
Executing the Attack
The secondary payload retrieves benign-looking PNG images from servers controlled by the attackers. These images may appear innocuous, but they are adeptly crafted to conceal hidden payload data within their pixel channels. The extracted data is then reconstructed into a portable executable and DLL. After the successful execution of these tasks, the original downloaded components are deleted, effectively erasing traces of the attack.
To maintain a foothold within the infected system, the malware establishes persistence by creating a Registry Run key and a scheduled task that relaunches the LockScreenContentServer.exe every hour. The attackers further mask their activities by applying system and hidden attributes to the ProgramData directory, rendering their staging ground less visible to security measures.
Information Gathering and Network Access
Microsoft has reported that the TerminalFix campaign actively engages in internal reconnaissance, gathering crucial system information and probing Active Directory structures. The malware is capable of enumerating users, computers, domain trusts, and domain administrators, while also scanning for high-value internal assets such as domain controllers, databases, backup systems, gateways, and mail servers.
The attackers implement an embeddable Python runtime alongside a specific custom implant named client.py. This implant is executed through pythonw.exe, establishing a connection to gitnow[.]dev over a TLS-encrypted channel. The connection is upgraded to WebSocket, enabling malicious operators to relay arbitrary TCP traffic seamlessly. This SOCKS5-style handling permits access to internal targets—be it IPv4, IPv6, or hostname-based—accessible from any infected endpoint.
Implications and Recommendations
While Microsoft has not observed any follow-on intrusion activities during their analysis, the combination of internal reconnaissance and the establishment of reverse tunnels positions infected systems as potential launch points for lateral movement, credential theft, data exfiltration, or even ransomware deployment.
To combat these threats, cybersecurity defenders are urged to investigate users who have interacted with suspicious CAPTCHA prompts or executed atypical PowerShell commands. Key indicators of compromise include abnormal instances of LockScreenContentServer.exe running outside its standard directory, hidden folders within ProgramData, and the presence of the rogue dui70.dll adjacent to executable files. Additional concerns include uncharacteristic Run keys or scheduled tasks, unusual activity related to pythonw.exe, and outbound connections to suspected tunnel infrastructure.
Organizations are also advised to limit unnecessary use of PowerShell and Windows Terminal access, enable script block logging, and apply stringent application control policies. Most importantly, user training should emphasize a cardinal rule: legitimate CAPTCHA interfaces will never request users to paste commands into a terminal.
In light of these developments, strengthening investigative capabilities remains paramount for security teams, allowing them to identify and address suspicious activities swiftly, thereby mitigating potential business impacts from cybersecurity threats.