Microsoft describes TerminalFix: fake CAPTCHA, DLL sideloading and tunnel encrypted to gitnow.dev

Microsoft has published an analysis of a new variant of "ClickFix" campaigns that researchers have baptized as TerminalFix. According to the company, the attack takes advantage of committed websites to show false challenges like Cloudflare CAPTCHA that induce unprepared visitors to copy and run a malicious command on Windows Terminal or PowerShell. The ultimate objective is to establish an inverse tunnel from the infected machine that allows the attackers to navigate the victim's internal network and to execute lateral recognition and movement.

The details that Microsoft has confirmed describe a chain of attack in several phases. First, the victim is directed by a legitimate page committed to a screen that fakes a CAPTCHA and requests to paste and run a long command on the Windows terminal. That command download a ZIP file containing a legitimate executable called "LockScreenContentServer.exe" along with a malicious DLL "dui70.dll." The technique used is the classic DLL sideloading: Windows loads the malicious DLL from the same directory as the legitimate binary, which allows the attacker to run code without signing through a legitimate system component.

The DLL sideloaded, according to the report, removes additional payloads hidden by steganography within PNG images stored in external domains (Microsoft mentions "bestsocialmedianewspapper [.] com" and "offlineuppater [.] com"). It then establishes persistence through Registry Run keys and programmed tasks, performs a wide recognition of Active Directory - including listing of domain administrators, user searches and equipment and surveys to named servers - and finally deploys a command and control implant developed in Python ("client.py").

The Python implant creates an inverse tunnel that encapsulates arbitrary TCP traffic within an encrypted WebSocket channel pointing to "gitnow [.] dev: 443," which allows the attacking server to reach any accessible host from the engaged machine. Microsoft also observed a persistent PowerShell routine that monitors a text file in search of new commands, runs them with Invoke-Expression and writes the results in an output file, a technique that facilitates silent remote control of the computer.

Confirmed facts by Microsoft publication: the redirection tactic to the terminal instead of the Run (Win + R) dialogue; initial delivery by pages committed to false CAPTCHAs; the existence of a ZIP with LockScreenContentServer.exe and dui70.dll; the use of steganography in remote PNGs; persistence by Run keys and programmed tasks; recognition of Active Directory and the presence of an inverse tunnel implemented in Python using WebSocket encrypted and connecting to gitnow [.] dev: 443.

Still uncertain aspects: Microsoft does not publicly attribute the attack to a named actor or quantify the actual scope of commitments in business environments. It is also not clear how many organizations were affected or whether the addresses and domains observed are still active at the time of reading this article. In addition, although the technique is effective for running complex scripts, the real success rate against networks with modern controls (AppLocker, WDAC, PowerShell and EDR execution policies) may vary.

The practical risk of TerminalFix lies in the combination of social engineering and system tolerance at legitimate binary load. Forcing the user to paste and run a command reduces the need for software vulnerabilities; the rest of the chain - sideloading, steganography, reverse tunnel - gives attackers the ability to explore domains, scale privileges and move additional payloads, including tools to exfilter data or deploy ransomware.

If your organization manages Windows environments, the recommended measures are concrete and should be prioritized in this practical order. First, reduce the attack surface by blocking or restricting the execution of PowerShell and standard user terminals using AppLocker, Windows Defender Application Control (WDAC) or group policies. Microsoft and official documentation offer controls to implement these solutions; see AppLocker documentation for initial steps in business environments https: / / learn.microsoft.com / windows / security / amenat-protection / windows-defender-application-control / applocker / applocker-overview.

Second, enable and centralize the PowerShell registry, especially the Block Logging Script (Event ID 4104), and record the process activity and thread creation so that the EDR and SIEM telemetics can detect paste-and-run, encoded or obfuscated commands, and abnormal process activity that call DLL from out of normal locations. Microsoft summarizes research and guides on its security blog; it is appropriate to review its publications for commitment indicators (IoC) and observed tactics https: / / www.microsoft.com / security / blog /.

Third, establish exit and traffic detection controls: block or apply inspection to unusual destinations (e.g. entities mentioned by Microsoft: gitnow [.] dev and domains hosting PNGs) and monitor outgoing TLS connections from workstations to unusual ports. Check also the Run keys of the registry (HKCU / HKLM Software\\ Microsoft\ Windows\\ Current Version\\ Run), scheduled tasks and suspicious persistent files (PowerShell scripts that implement file loops), and collect memory from suspicious machines before turning them off if you suspect lateral movement.

Fourth, response procedures: immediately isolate any host with implantation evidence, block committed credentials and force changes in passwords and privileged sessions; perform forensic analysis in AD (search for new accounts, unusual delegations, changes in GPOs) and consider the reconstruction of strongly compromised systems. If the incident suggests access at the network level, treat the infrastructure as committed to the contrary.

Finally, work and training mitigation: educate users about not hitting commands from web pages or running scripts without IT personnel verification, and value disabling the Run dialog for profiles that do not need it or auditioning its use. The combination of technical controls, improved detection and training dramatically reduces the likelihood that a CAPTCHA-type deception will result in a deep intrusion.

TerminalFix shows that attackers continue to exploit human interaction with the operating system rather than relying only on bugs. Although many of the defenses against this campaign are known and applicable to existing technologies, their effectiveness depends on consistent implementation and continuous monitoring. Review application control configurations, strengthen registration and telemetry, and prepare response playbooks for incidents involving reverse tunnels and Active Directory recognition.