Microsoft Details TerminalFix ClickFix Reverse-Tunnel Backdoor

Fake CAPTCHA lures lead to enterprise network access

Microsoft has disclosed TerminalFix, a ClickFix variant that tricks visitors into running a malicious command in Windows Terminal or PowerShell. The campaign targets organisations in multiple sectors and begins on compromised websites displaying fake Cloudflare CAPTCHA verification pages.

Unlike conventional ClickFix activity, which typically tells a victim to use the Windows Run dialog, TerminalFix directs them to Windows Terminal or PowerShell. Microsoft researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan said this raises the chance that complex, multi-line scripts will execute successfully.

The pasted PowerShell command downloads a ZIP archive containing the legitimate executable LockScreenContentServer.exe and a malicious DLL named dui70.dll. The pairing is used for DLL sideloading, allowing the rogue library to run in the context of the legitimate binary.

Payloads concealed in images and a persistent tunnel

After execution, the sideloaded DLL retrieves further payloads concealed in PNG images from external domains including bestsocialmedianewspapper[.]com and offlineupdater[.]com. The malware establishes persistence through Registry Run keys and scheduled tasks, then performs domain reconnaissance before deploying a Python-based reverse-tunnel implant.

The implant, client.py, can tunnel arbitrary TCP traffic to attacker-controlled infrastructure at gitnow[.]dev:443 through an encrypted WebSocket channel. It also allows the command-and-control server to reach hosts visible from the compromised machine, effectively creating network-level proxy access into the victim environment.

Microsoft observed system metadata collection, domain trust discovery, domain administrator enumeration, Active Directory searches for users and computers, and pings to named servers to map internal topology. A persistent PowerShell file-watch loop also monitors a text file for commands, runs them through Invoke-Expression, and writes results to an output file.

Controls to prioritise

Microsoft warned that reverse-tunnel access could help an intruder identify and reach further systems, escalate privileges, disable security controls, exfiltrate data, or deploy ransomware. The combination of social engineering, sideloading and internal discovery makes the initial user action only the first stage of the intrusion.

Organisations can reduce exposure by restricting PowerShell and Windows Run execution for standard users with AppLocker, Application Control for Windows, or Group Policy. They should consider blocking or auditing Win+R where it is unnecessary, monitor for DLL sideloading, enable PowerShell script block logging, and train staff not to copy verification commands into a terminal. The practical implication is that endpoint controls and user awareness must address the fake CAPTCHA prompt before TerminalFix gains a foothold.