TerminalFix campaign deploys a reverse tunnel through multistage intrusion

The TerminalFix campaign, a variant of ClickFix, uses compromised websites to display fake Cloudflare CAPTCHA overlays that trick users into copying and executing malicious PowerShell commands via Windows Terminal or PowerShell. This multi-stage attack chain involves downloading a ZIP archive containing a legitimate signed binary (LockScreenContentServer.exe) and a malicious DLL (dui70.dll) for DLL sideloading. The sideloaded DLL executes PowerShell scripts that download payloads hidden inside PNG images using steganography. The campaign establishes dual persistence through Registry Run keys and scheduled tasks, performs extensive Active Directory reconnaissance including domain trust enumeration and domain admin discovery, and deploys a Python-based reverse-tunnel implant that tunnels arbitrary TCP traffic over encrypted WebSocket channels to attacker infrastructure. This reverse tunnel provides attackers with persistent, stealthy network-level access to the compromised host and potentially the internal network. Microsoft observed no direct exploitation beyond reconnaissance and tunneling but warns that such access could enable lateral movement, credential theft, and ransomware deployment.

The campaign provides attackers with persistent, stealthy network-level proxy access through a compromised host, enabling extensive Active Directory reconnaissance and potential lateral movement within an organization's internal network. This access could facilitate privilege escalation, disabling of security controls, sensitive data exfiltration, and ransomware deployment. The use of DLL sideloading, steganography, and multi-stage payload delivery increases the difficulty of detection and mitigation, making this a serious threat to enterprise environments.

No official patch or fix is available as this is a multi-stage attack leveraging social engineering and legitimate Windows features. Organizations should focus on user awareness to prevent execution of unsolicited PowerShell commands, monitor for suspicious PowerShell activity, and detect DLL sideloading and steganographic payload retrieval behaviors. Investigate affected devices as potential network pivot points and hunt for lateral movement and credential exposure. Employ endpoint detection and response (EDR) tools capable of identifying the described attack techniques. Follow vendor guidance and Microsoft’s detailed detection and hunting recommendations in their advisory.