TerminalFix: Fake Cloudflare CAPTCHAs Push Victims Into a PowerShell Reverse Tunnel

Microsoft Threat Intelligence has documented a social-engineering campaign it calls TerminalFix, an evolution of the ClickFix technique that trades the Windows Run dialog for Windows Terminal or PowerShell and chains a signed-binary DLL sideload, steganographic payload delivery, and a custom Python reverse-tunnel implant into a full internal-network foothold. The company published its analysis on 28 August 2026, and independent reporting from The Hacker News the same day corroborates the chain end to end.

The campaign matters because it is not another single-shot infostealer dropped by a fake CAPTCHA. It is a patient, multi-stage intrusion that ends with an attacker able to route traffic into your internal network from a compromised endpoint. Every stage is built to look ordinary: a legitimate signed Windows executable, PNG images, Python from the official python.org distribution.

What Happened

TerminalFix begins on a compromised website that renders a counterfeit Cloudflare Turnstile overlay — the real Cloudflare logo, a "Verify you are human" checkbox, and a spinner animation. Microsoft observed the lure served from at least one compromised site, `linked-log[.]com`. Instead of the familiar ClickFix instruction to press Win+R and paste into the Run dialog, TerminalFix tells the victim to open Windows Terminal or PowerShell and paste a command that has already been copied to their clipboard. Microsoft's assessment is that this raises the success rate for complex, multi-line scripts, which the Run dialog handles poorly.

The pasted PowerShell command downloads a ZIP archive from attacker infrastructure using a custom User-Agent header, extracts its contents to `C:\ProgramData\f47f2a8c21c9df4e`, silently launches a batch file named `1.bat`, and prints fake Cloudflare verification text to keep the victim believing the check succeeded. The ClickFix social-engineering pattern is worth understanding on its own, because the fake-CAPTCHA lure is now a delivery mechanism for far more than commodity malware.

Technical Analysis

The ZIP (SHA-256 `18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f`) contains two files: `LockScreenContentServer.exe`, a legitimate signed Windows binary, and `dui70.dll`, a malicious library masquerading as the Windows DirectUI Engine. Because the signed executable has a static import dependency on `dui70.dll`, the Windows loader resolves the attacker's copy from the application directory before the real one — the technique Microsoft classifies as DLL sideloadingDLL Sideloading🛡️An attack technique that places a malicious DLL alongside a legitimate signed executable so the Windows loader resolves and loads the attacker's library instead of the real one, running malicious code under the trust of the signed program. (MITRE ATT&CK T1574.001/.002). The malicious DLL decodes an embedded resource entirely in memory and transfers execution to it, never writing that stage to disk. Understanding how DLL sideloading abuses trusted binaries explains why an allowlist keyed on file signatures alone does not stop this stage.

The next stage retrieves PNG images from failover domains `bestsocialmedianewspapper[.]com` and `offlineupdater[.]com` and reconstructs an embedded binary from them using steganographySteganography🛡️The practice of hiding data inside another file, such as embedding an executable payload within the pixel data of an image, so the malicious content moves as an ordinary file and evades inspection that looks for executable downloads.: the extraction routine reads each pixel's RGBA channels, with the first 8 bytes encoding the payload length as a 64-bit integer. Three images are downloaded, the extracted fragments are concatenated, and the source images are deleted. Because the payloads move as ordinary image files, network inspection that looks for executable downloads sees nothing unusual.

Persistence is layered: a randomized HKCU Run key (entry name `LockScreenContentServer_MuODG5yBM`), a scheduled task that re-executes every 60 minutes, and `attrib +h +s` to hide the working directory as a system folder. The malware then runs bilingual reconnaissance — English, Spanish, and German locale variants of `systeminfo` filters — and enumerates the domain with `nltest /domain_trusts`, `nltest /dclist:`, `net group "domain admins" /domain`, and ADSI searches for user descriptions and computers, combined with a targeted ping sweep to locate domain controllers, databases, backup systems, gateways, and mail servers.

The final payload is `client.py`, a Python reverse-tunnel implant run via `pythonw.exe` from the official Python 3.14.5 embeddable distribution, so no window appears and no attacker-authored interpreter is dropped. It connects to `gitnow[.]dev:443`, upgrades to a TLS WebSocket at the `/tunnel` endpoint with certificate verification disabled (`CERT_NONE`), and rotates among four realistic browser User-Agent strings. Its custom 7-byte binary protocol (message type, stream ID, length) multiplexes streams and supports SOCKS5-style address parsing, letting the C2 server instruct the implant to reach any internal host and port. In effect, the compromised workstation becomes a proxy into the network. Recognizing the outbound behavior of a reverse-tunnel implant is often the most reliable way to catch this stage, because everything before it is designed to look legitimate.

Who Is Affected

Microsoft reports the campaign targeting organizations across multiple industries and did not attribute it to a named actor or disclose victim counts. The technique is platform-agnostic in spirit but this campaign targets Windows endpoints, and the domain-reconnaissance stage is built for Active Directory environments — the payoff is greatest where a single foothold can be pivoted across an internal network. Any organization whose users can open Windows Terminal or PowerShell and run unrestricted scripts is exposed to the initial-access stage.

Immediate Actions

The most effective control is preventing the paste-and-run step from ever executing. Microsoft recommends restricting PowerShell for standard users with AppLocker or App Control for Windows, blocking or auditing the Windows Run dialog, and creating an App Control policy that prohibits launching native Windows binaries from Run. Configure Windows Terminal to warn when pasted text contains multiple lines. Enforce PowerShell Constrained Language ModeConstrained Language Mode🛡️A PowerShell operating mode that restricts access to sensitive language features such as arbitrary .NET type instantiation and Win32 API calls, blocking common in-memory attack tradecraft while allowing most legitimate administrative scripting to continue., set execution policyExecution Policy🛡️A PowerShell security feature that determines the conditions under which PowerShell loads configuration files and runs scripts, ranging from Restricted (no scripts) to Bypass (no restrictions). to `AllSigned` or `RemoteSigned`, and enable script block logging to capture obfuscated commands.

For detection, alert on `LockScreenContentServer.exe` executing from any path other than `C:\Windows\SystemApps`, and hunt for `pythonw.exe` or `python.exe` command lines referencing `client.py` with `--server`, `--uuid`, `cert.pem`, and `gitnow.dev`. Block the network indicators `gitnow[.]dev`, `bestsocialmedianewspapper[.]com`, and `offlineupdater[.]com`. Enable Attack SurfaceAttack Surface🛡️The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching. Reduction rules that block obfuscated scripts and executables launched by script interpreters, and turn on network and web protection in Microsoft Defender for Endpoint. Microsoft Defender detections for the chain include `Trojan:Win32/ClickFix.*`, `Trojan:Win64/DLLHijack.DAB!MTB`, and `Trojan:Python/Indigo.SA`.

Long-Term Outlook

TerminalFix is a reminder that the user is now a scripted deployment step. As browsers and email gateways get better at blocking attachments and macros, adversaries increasingly ask the victim to run the payload themselves — and the fake CAPTCHA has become a trusted-looking wrapper for that request. Moving the instruction from the Run dialog to a full terminal is a small change with a large effect: it normalizes pasting multi-line scripts into a shell, a habit that defenders should treat as a policy problem, not just an awareness one. The durable fix is to remove the capability from standard users rather than to train them to resist it. Expect the fake-CAPTCHA-to-terminal pattern to keep spreading, and expect the payloads behind it to keep favoring living-off-the-land tooling — signed binaries, official interpreters, and ordinary-looking image files — precisely because those artifacts survive signature-based inspection.

Sources

• Microsoft Security Blog, "TerminalFix campaign deploys a reverse tunnelReverse Tunnel🛡️A connection initiated from inside a network outward to an attacker-controlled server, allowing that server to route traffic back through the compromised host to reach internal systems. Because the connection originates internally, it evades controls focused on inbound traffic. through multistage intrusion," 28 Aug 2026: https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• The Hacker News, "TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor," 28 Aug 2026: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html