- The Mess: Microsoft has uncovered TerminalFix, a new ClickFix campaign that uses fake Cloudflare CAPTCHA pages to trick users into executing PowerShell commands. The attack then deploys DLL sideloading, steganography and a custom reverse tunnel.
- The Damage: A compromised Windows workstation becomes a persistent proxy into the internal network, allowing attackers to map Active Directory and potentially reach additional systems.
- The Fix: Never paste commands into Windows Terminal or PowerShell because a website tells you to “verify you’re human”; investigate suspicious
LockScreenContentServer.exe, hiddenProgramDatafolders and unexpected outbound WebSocket traffic.
The CAPTCHA isn’t checking whether you’re human.
It’s checking whether you’ll execute malware.
TerminalFix is a new ClickFix variant documented by Microsoft that starts with a compromised website and a very convincing Cloudflare-style verification screen.
The victim clicks.
The website copies a command.
The victim opens Terminal.
The victim pastes it.
And the attacker gets a foothold.
ClickFix Gets More Dangerous
Traditional ClickFix campaigns usually tell victims to press Win+R and paste a command.
TerminalFix changes the recipe.
The victim is instructed to open Windows Terminal or PowerShell instead.
That matters because Terminal can handle much longer and more complex commands.
The fake CAPTCHA provides the social engineering.
PowerShell provides the execution.
The rest of the attack happens quietly in the background.
The First Payload Looks Legitimate
The command downloads a ZIP archive containing two important files:
LockScreenContentServer.exe
and
dui70.dll
The first is a legitimate Windows executable.
The second is malicious.
The attackers place them together and abuse DLL sideloading so the legitimate executable loads the malicious DLL.
The victim therefore doesn’t need to launch some obviously suspicious malware.exe.
A trusted Windows binary does the dirty work.
Then the Malware Hides Inside PNGs
The malicious DLL downloads apparently harmless PNG images from attacker-controlled infrastructure.
They’re not really images.
The attackers hide payload fragments inside the image data using steganography.
The malware extracts those fragments locally and reconstructs the next stage.
That gives defenders another problem.
A normal security system sees:
PowerShell → ZIP → signed executable → PNG
The attacker sees:
initial loader → DLL → hidden payload → backdoor
It Starts Mapping Active Directory
TerminalFix isn’t satisfied with stealing credentials from one workstation.
Microsoft observed extensive reconnaissance after infection.
The malware searches for:
- domain trusts
- domain administrators
- users
- computers
- administrative groups
- reachable servers
It also performs network discovery to identify systems that could become the next targets.
That’s the point where a phishing click becomes an enterprise incident.
The infected PC becomes a map of the organization.
Then Comes the Reverse Tunnel
The final stage is a custom reverse-tunneling implant.
It establishes an encrypted WebSocket connection back to attacker infrastructure.
That connection can turn the compromised machine into a network-level proxy.
The attacker doesn’t necessarily need direct Internet access to an internal server.
The infected workstation already has that access.
So the path becomes:
Attacker → reverse tunnel → compromised PC → internal network
That’s extremely useful for lateral movement.
Persistence Is Built In
TerminalFix also establishes persistence through Windows Registry Run keys and scheduled tasks.
A PowerShell component can monitor a file for commands, execute them and save the results.
The attacker therefore gets more than a temporary foothold.
They get a system they can return to.
This Is Why Fake CAPTCHAs Work
The attack doesn’t exploit some exotic Windows vulnerability.
It exploits trust.
People recognize Cloudflare.
They recognize CAPTCHA.
They see:
“Verify you are human.”
Then the page tells them to perform something that sounds technical but harmless.
The security boundary disappears because the victim crosses it manually.
That’s ClickFix at its core.
What Microsoft Wants Defenders Watching
Microsoft recommends investigating machines where users interacted with suspicious CAPTCHA pages.
Particularly interesting indicators include unexpected execution of LockScreenContentServer.exe, hidden directories under ProgramData, suspicious PowerShell activity and outbound connections associated with the campaign.
PowerShell logging and application-control policies can also make this type of attack considerably easier to detect and contain.
Bugstoday Opinion
ClickFix was already bad.
TerminalFix makes it look much more like a proper intrusion framework.
Fake CAPTCHA → PowerShell → DLL sideloading → steganography → AD reconnaissance → reverse tunnel.
That’s not a simple infostealer.
That’s an initial-access technique turning directly into internal network access.
And the attacker doesn’t need to convince the victim to download an executable.
They convince them to prove they’re human.
By running the attack themselves.
Bugstoday verdict: if a CAPTCHA asks you to open PowerShell, you’re not proving you’re human. You’re volunteering to become the attacker’s network proxy.
Today’s Bugs. Tomorrow’s Breaches.
