TerminalFix: new ClickFix variant exploits Windows Terminal for reverse tunnel

New TerminalFix variant exploits fake CAPTCHAs for reverse tunnels in corporate networks

A new variant of ClickFix, identified as TerminalFix, exploits compromised websites to deceive users with fake Cloudflare CAPTCHA prompts, tricking them into executing harmful PowerShell commands in Windows Terminal. Unlike traditional ClickFix campaigns, often associated with infostealer malware infections, this variant implements a multi-stage intrusion chain that allows attackers to establish a reverse tunnel to the victim's internal network.

Quick Response

New TerminalFix Capabilities

The peculiarity of TerminalFix lies in the use of Windows Terminal or PowerShell to execute complex multi-line scripts. Microsoft has detected these activities in the wild, although it has not observed direct interactions. Attackers could leverage the obtained access for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or ransomware distribution.

Infection Mechanism

The infection vector begins with a fake CAPTCHA prompt that instructs the user to execute a pre-loaded PowerShell command from the clipboard. This command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL, which decodes and launches an obfuscated payload directly in memory.

Steganography for Concealment

In the second stage, attackers use steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads these images from the command and control (C2) server and reconstructs the embedded payloads on the disk.

Persistence and Information Gathering

The malware establishes persistence through a scheduled task and a Registry run key, configured to execute every hour. While active, it performs information gathering activities, probing domain controllers, databases, backup servers, gateways, and email systems, collecting system information and enumerating Active Directory (AD).

Reverse Tunnel for Lateral Movement

The key component is a custom Python reverse tunnel module that connects to an outbound address (gitnow[.]dev:443) via encrypted WebSocket, supporting arbitrary TCP proxy in the SOCKS5 style. This allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports accessible from the victim.

Advanced Reverse Tunnel Features

The reverse tunnel also supports multiplexing multiple connections over a single WebSocket, rotating realistic User-Agent strings, keepalive, and remote shutdown. As Microsoft underscores, this can turn the infected endpoint into a network pivot, providing operators with a path to systems discovered during previous AD and network information gathering operations.