Microsoft Uncovers 'TerminalFix' Social Engineering Campaign

A sophisticated social engineering campaign has been uncovered by Microsoft Threat Intelligence, which uses a custom Python-based reverse tunnel implant to grant attackers access to an organization's internal network.

The 'TerminalFix' campaign is a variant of the ClickFix technique that tricks victims into copying and pasting commands into Windows Terminal or PowerShell. This allows attackers to download and execute malicious payloads from their infrastructure, including DLLs disguised as legitimate files.

The malware uses steganography to embed malicious binaries within PNG image files, which are then extracted and launched using PowerShell scripts. It also collects system metadata, performs domain trust discovery, and sets up a primitive but effective asynchronous command-and-control mechanism.

Ultimately, the final payload is the custom Python-based reverse tunnel implant, which connects outbound over TLS port 443 and upgrades to a WebSocket, granting the attacker full SOCKS-style TCP proxy access through the victim's network.