Microsoft warns of TerminalFix attacks deploying reverse tunnels

TerminalFix is a ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised websites to lure victims into executing malicious PowerShell commands in Windows Terminal. The initial command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL that launches an obfuscated payload in memory. The second stage uses steganography to hide executables and DLL fragments in PNG images downloaded from the attacker’s C2 server, which are reassembled on disk. Persistence is maintained via scheduled tasks and Registry Run keys. The malware performs reconnaissance targeting domain controllers, databases, backup servers, gateways, mail systems, and Active Directory. A custom Python reverse tunnel module connects outbound over an encrypted WebSocket to a remote server, supporting SOCKS5 proxying and multiplexing multiple connections. This tunnel enables attackers to pivot into internal networks discovered during reconnaissance. Microsoft discovered these attacks but did not observe active exploitation. The attack chain enables attackers to potentially perform lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware deployment.

If successfully executed, TerminalFix can provide attackers with a reverse tunnel into the victim’s internal network, enabling network pivoting and access to internal resources. This access could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware deployment. The attack bypasses typical endpoint protections by using legitimate signed executables and obfuscated payloads loaded in memory. The persistence mechanisms and reconnaissance capabilities increase the risk of prolonged undetected compromise.

Microsoft recommends restricting and logging PowerShell execution to prevent unauthorized script execution. Monitoring for the process 'LockScreenContentServer.exe' running outside its normal path is advised. Hardening browsers and endpoint protections can reduce exposure. If compromise is suspected, investigate for lateral movement and rotate all credentials, including domain administrator credentials accessible from the infected host. These steps align with Microsoft's guidance and address the specific attack techniques used by TerminalFix.