TerminalFix Spreads Network Infiltration Tool via Fake CAPTCHAs
Microsoft uncovered new malware infiltrating corporate networks through PowerShell with reverse-tunnel capabilities.
1TerminalFix's Target and Method
Microsoft's newly identified malware variant, dubbed 'TerminalFix', tricks users into executing commands in Windows Terminal or PowerShell. Unlike traditional ClickFix attacks, it increases the likelihood of successfully running multi-line scripts. The attack starts through compromised websites serving fake Cloudflare CAPTCHA verifications.
2Multi-Stage Attack Chain
TerminalFix follows a sophisticated process using DLL sideloading, steganographic payload extraction, Active Directory reconnaissance, and a custom reverse-tunnel implant. The PowerShell command downloads a ZIP archive containing a legitimate binary ('LockScreenContentServer.exe') and a malicious DLL ('dui70.dll') to initiate a DLL sideloading attack.
3Hidden Payloads and Persistence Mechanisms
The sideloaded DLL retrieves payloads hidden within PNG images from external domains like 'bestsocialmedianewspapper[.]com' or 'offlineupdater[.]com'. It establishes persistence via Registry Run keys and scheduled tasks. After domain reconnaissance, it deploys a Python-based reverse-tunnel C2 implant.
4Reverse-Tunnel Backdoor
The backdoor named 'client.py' can tunnel arbitrary TCP traffic through an encrypted WebSocket channel to 'gitnow[.]dev:443'. Attackers gain access to other systems on the victim's network. This type of infiltration is considered particularly dangerous as it provides direct access to an organization's internal network.
5Powerful Reconnaissance Capabilities
The attack also includes a persistent PowerShell file-watch loop monitoring a text file for new commands. Commands are executed via Invoke-Expression with results written to an output file. These capabilities allow attackers to escalate privileges, disable security controls, and exfiltrate sensitive data.
6Risks for Enterprise Environments
Microsoft emphasizes that TerminalFix poses serious threats including ransomware deployment. The attackers' reconnaissance and reverse-tunnel capabilities enable them to identify and target additional systems from a compromised host. Such access could lead to devastating consequences in corporate environments.
7Microsoft's Recommended Protection Methods
To mitigate the threat, Microsoft recommends restricting PowerShell and Run dialog execution for standard users via AppLocker, Windows Application Control, or Group Policy. Blocking or auditing the Windows Run dialog ('Win+R') if unnecessary, monitoring for DLL sideloading indicators, and training employees against ClickFix attacks are advised.
8Importance of Security Measures
Enabling PowerShell script block logging can help detect and analyze obfuscated or encoded commands. Microsoft calls for proactive measures to identify exploitable risks faster, prioritize critical issues, and reduce exposure before AI-powered attacks accelerate the threat landscape.
Original article: The Hacker News — TerminalFix: Sahte CAPTCHA'larla Ağ Sızma Aracı Yayıyor