Microsoft Warns of TerminalFix Campaign Using Fake CAPTCHA to Deploy Reverse Tunnel
A sophisticated cyber threat has been identified by Microsoft, targeting organizations and deploying a reverse-tunnel implant via fake Cloudflare CAPTCHA prompts. The 'TerminalFix' campaign, a variant of ClickFix, tricks users into executing PowerShell commands that download malware and establish persistence on compromised devices.
The infection begins when a user interacts with a convincing Cloudflare Turnstile-style overlay on a compromised website, which then copies a malicious command to the clipboard and instructs the user to open Windows Terminal or PowerShell and paste it. The command downloads a ZIP archive, extracts it under a hidden ProgramData directory, and launches a batch file in the background.
The malware establishes persistence via a Registry Run key and a scheduled task that restarts LockScreenContentServer.exe every 60 minutes. It also hides its ProgramData directory using system and hidden attributes. The campaign collects system details, enumerates Active Directory users, computers, trusts, and domain administrators, and probes likely infrastructure such as domain controllers, databases, backup systems, gateways, and mail servers.
Most significantly, the operation deploys an embeddable Python runtime and a custom client.py implant launched through pythonw.exe. The implant connects to gitnow[.]dev over TLS on port 443, upgrades the connection to a WebSocket, and relays arbitrary TCP traffic. Its SOCKS5-style parsing lets the operator direct connections to internal IPv4, IPv6, or hostname targets reachable from the infected machine.