Microsoft has disclosed a new variant of the ClickFix malware campaign, termed TerminalFix, which aims to deceive users into executing harmful commands via Windows Terminal or PowerShell. This approach enhances the likelihood of executing complex, multi-line scripts compared to traditional methods that direct victims to the Windows Run dialog.
Mechanism of the Attack
The TerminalFix campaign targets various organizations by exploiting compromised websites to present fake Cloudflare CAPTCHA verifications. These prompts encourage unsuspecting visitors to copy and run a malicious PowerShell command. According to Microsoft security researchers, this attack involves a sophisticated multi-stage process that includes DLL sideloading, steganographic payload extraction, and extensive reconnaissance within Active Directory.
Payload Details
The malicious PowerShell command is designed to download a ZIP file containing a legitimate binary file, LockScreenContentServer.exe, alongside a rogue DLL, dui70.dll. This initiates a DLL sideloading attack, where the sideloaded DLL retrieves subsequent payloads concealed within PNG images from external domains, such as bestsocialmedianewspapper[.]com and offlineupdater[.]com.
Impact and Capabilities
The backdoor, referred to as client.py, establishes a reverse-tunnel command-and-control (C2) implant, enabling arbitrary TCP traffic to be tunneled back to the attacker’s infrastructure at gitnow[.]dev:443. This capability allows attackers to gain persistent access to the victim’s network and conduct reconnaissance, including:
- Collecting system metadata
- Performing domain trust discovery and admin enumeration
- Pinging servers to map internal network topology
Microsoft has highlighted the dangers of this intrusion, noting that it grants attackers direct access to an organization’s internal network, which could facilitate privilege escalation, data exfiltration, and the deployment of ransomware.
Mitigation Strategies
To mitigate the risks posed by TerminalFix, Microsoft recommends several strategies, including:
- Restricting PowerShell and Run dialog execution for standard users through AppLocker or Group Policy
- Monitoring for indicators of DLL sideloading
- Training employees to recognize ClickFix attacks
- Enabling PowerShell script block logging to detect obfuscated commands
These measures can help organizations safeguard against the sophisticated techniques employed in the TerminalFix campaign.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
