Fake Cloudflare CAPTCHA Drops a Reverse Tunnel Inside Windows Networks

• The Mess: Microsoft has uncovered TerminalFix, a new ClickFix campaign that tricks users into copying a malicious PowerShell command from a fake Cloudflare CAPTCHA into Windows Terminal. The attack then builds a multi-stage infection with DLL sideloading, steganography and a persistent reverse tunnel.
• The Damage: This isn’t another disposable infostealer. The final implant gives attackers network-level proxy access through the compromised machine, allowing them to probe internal systems and potentially pivot deeper into the organization.
• The Fix: Block or restrict PowerShell for standard users, enable Windows Terminal paste warnings, monitor LockScreenContentServer.exe running outside C:\Windows\SystemApps, and investigate any host showing TerminalFix indicators.

The fake CAPTCHA is the bait.

The real attack starts when the victim copies what appears to be a harmless verification command into Windows Terminal.

Microsoft calls the campaign TerminalFix because it moves the classic ClickFix trick away from the Windows Run dialog and directly into Terminal or PowerShell.

The result is considerably more dangerous than a simple malware download.

The CAPTCHA Is Fake

The victim lands on a compromised website.

Instead of the expected content, a convincing Cloudflare Turnstile overlay appears.

“Verify you are human.”

The victim clicks.

The page then tells them to open Windows Terminal and paste a command supposedly required to complete verification.

That’s the trick.

The command is already sitting in the clipboard.

The user only needs to execute it.

And once they do, the attacker gets their first foothold.

Then Windows Starts Loading the Wrong DLL

TerminalFix downloads a ZIP archive into C:\ProgramData.

Inside it is a legitimate Microsoft-signed executable called LockScreenContentServer.exe and a malicious DLL named dui70.dll.

The legitimate executable is abused for DLL sideloading.

Windows loads the malicious DLL from the application’s directory instead of the legitimate system copy.

The attacker has now moved from a social-engineering trick to native code execution.

The interesting part is what comes next.

Malware Hidden Inside PNG Images

The malicious DLL downloads PNG files from attacker-controlled infrastructure.

They aren’t normal images.

Payload fragments are hidden inside their pixel data using steganography.

The malware extracts those fragments and reconstructs additional executable components on the victim’s machine.

That gives the attackers another layer of concealment.

A security tool looking for an obvious executable download may instead see a collection of perfectly ordinary-looking PNG files.

Persistence Comes Before Recon

TerminalFix establishes persistence through both Registry Run keys and scheduled tasks.

Then it starts mapping the environment.

Microsoft observed:

• Active Directory user enumeration
• Domain administrator discovery
• Domain trust enumeration
• Computer enumeration
• Server ping sweeps
• System information collection

The campaign isn’t interested only in the infected PC.

It’s interested in what the PC can reach.

The Final Payload Is a Network Tunnel

The final stage downloads a Python runtime and a custom tunneling client.

It runs through pythonw.exe, keeping the process hidden from the user.

The implant establishes an encrypted WebSocket connection to attacker infrastructure and provides SOCKS-style TCP proxy access through the compromised machine.

That’s the point where TerminalFix becomes a serious enterprise intrusion tool.

The attacker can potentially use the infected workstation as a bridge into internal infrastructure.

The compromised browser session isn’t the prize.

The network is.

This Is Why ClickFix Keeps Getting Worse

ClickFix originally relied heavily on convincing users to execute commands through Run or PowerShell.

TerminalFix changes the delivery path.

Windows Terminal is better suited to handling long and multi-line commands, which gives attackers more room to build complicated infection chains.

And the campaign combines several techniques:

social engineering → PowerShell → DLL sideloading → steganography → persistence → AD reconnaissance → reverse tunnel

That’s a proper intrusion chain.

Not a popup scam.

Bugstoday Opinion

The dangerous part of TerminalFix isn’t the fake CAPTCHA.

We’ve seen fake CAPTCHAs before.

The dangerous part is what happens after the user clicks.

A single copied command can turn a browser visit into a persistent foothold with Active Directory reconnaissance and a reverse tunnel into the internal network.

And that’s the uncomfortable evolution of ClickFix.

Attackers aren’t just trying to steal browser passwords anymore.

They’re trying to turn the victim’s workstation into a network access point.

Bugstoday verdict: never paste a “verification” command into Windows Terminal because a website told you to. A CAPTCHA should verify that you’re human — not ask you to become the malware loader.

Today’s Bugs. Tomorrow’s Breaches.