Microsoft Warns Fake Cloudflare CAPTCHAs Are Spreading TerminalFix Malware

Microsoft uncovered the TerminalFix campaign, a new ClickFix variant found on compromised websites. Instead of primarily installing infostealers, the campaign creates persistent access that attackers could use to reach other systems inside a victim’s network.

Victims see a fake CAPTCHA that tells them to run a command through Windows Terminal or PowerShell. Microsoft says the use of Windows Terminal also gives attackers more flexibility to execute complex, multi-line scripts than traditional ClickFix techniques.

TerminalFix starts with a malicious PowerShell command

The fake verification prompt convinces users to execute a PowerShell command manually.

That command downloads a ZIP archive containing a legitimate signed executable alongside a malicious DLL. The DLL then decodes an obfuscated payload and launches it directly in memory.

The process helps the malware move through several stages before establishing a foothold on the system.

Malware components are hidden inside PNG images

TerminalFix also uses steganography to conceal malicious components.

The second stage downloads three PNG images containing hidden executable and DLL fragments. A script extracts those fragments and reconstructs the malware payloads on disk.

The malware then establishes persistence using both a scheduled task and a Registry Run key. It configures the malicious components to execute every hour.

TerminalFix searches the internal network for valuable systems

After establishing persistence, TerminalFix starts examining the victim’s network.

The malware looks for systems that could provide attackers with additional access or valuable data, including domain controllers, database servers, backup servers, network gateways, and mail systems.

This reconnaissance could help attackers identify targets for later stages of an intrusion.

Reverse tunnel turns the infected PC into a pivot point

The campaign’s main payload includes a custom Python reverse-tunnel module.

Attackers can use the compromised Windows PC to connect to internal IP addresses, hostnames, and ports that the infected device can access. This effectively gives them a pathway into parts of the network that may not be directly reachable from the internet.

The reverse tunnel supports multiple simultaneous connections, rotating browser User-Agent strings, keepalive functionality, and remote shutdown commands.

Microsoft warns that this setup can turn a compromised endpoint into a pivot point for attacks against other machines on the same internal network.

Access could lead to ransomware and credential theft

Microsoft did not observe hands-on attacker activity after the initial compromise during its investigation.

However, the access created by TerminalFix could support several follow-up attacks, including lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, and ransomware deployment.

The reverse tunnel could give attackers the network access needed to carry out those operations after compromising a single endpoint.

Microsoft recommends monitoring PowerShell and exposed credentials

Microsoft recommends that organizations restrict and log PowerShell execution to make suspicious activity easier to detect.

Security teams should also watch for LockScreenContentServer.exe running outside its legitimate path and strengthen browsers and endpoint security protections against ClickFix-style attacks.

Organizations that confirm an infection should investigate the wider environment for signs of lateral movement. Microsoft also recommends rotating potentially exposed credentials, including domain administrator credentials.

In other security news, Anthropic warns that Claude sessions are being stolen by malware, while malicious extensions are targeting crypto wallets on Chrome and Edge.