Terminal Fix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Summary: Microsoft disclosed a new ClickFix variant called TerminalFix that serves fake Cloudflare CAPTCHA prompts on compromised websites, directing visitors to paste a malicious PowerShell command into Windows Terminal or PowerShell rather than the Run dialog. The command downloads a ZIP with a legitimate binary (LockScreenContentServer.exe) and a rogue DLL (dui70.dll) for DLL sideloading, which pulls next-stage payloads from PNG images on external domains, establishes persistence via Registry Run keys and scheduled tasks, performs Active Directory reconnaissance, and deploys a Python reverse-tunnel implant (client.py) that tunnels TCP traffic to gitnow[.]dev:443 over an encrypted WebSocket channel.
Bottom line: The reverse tunnel gives an attacker a network-level proxy into the internal network from a single infected host, which Microsoft says can be used to escalate privileges, disarm security controls, exfiltrate data, and deploy ransomware.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026