TerminalFix: Fake Cloudflare CAPTCHAs Push Victims Into a PowerShell Reverse Tunnel

Microsoft Threat Intelligence has documented a social-engineering campaign it calls TerminalFix, an evolution of the ClickFix technique that trades the Windows Run dialog for Windows Terminal or PowerShell and chains a signed-binary DLL sideload, steganographic payload delivery, and a custom Python reverse-tunnel implant into a full internal-network foothold. The company published its analysis on 28 August 2026, and independent reporting from The Hacker News the same day corroborates the chain end to end.

The campaign matters because it is not another single-shot infostealer dropped by a fake CAPTCHA. It is a patient, multi-stage intrusion that ends with an attacker able to route traffic into your internal network from a compromised endpoint. Every stage is built to look ordinary: a legitimate signed Windows executable, PNG images, Python from the official python.org distribution.

What Happened

TerminalFix begins on a compromised website that renders a counterfeit Cloudflare Turnstile overlay: the real Cloudflare logo, a "Verify you are human" checkbox, and a spinner animation. Microsoft observed the lure served from at least one compromised site, linked-log[.]com. Instead of the familiar ClickFix instruction to press Win+R and paste into the Run dialog, TerminalFix tells the victim to open Windows Terminal or PowerShell and paste a command that has already been copied to their clipboard. Microsoft's assessment is that this raises the success rate for complex, multi-line scripts, which the Run dialog handles poorly.

The pasted PowerShell command downloads a ZIP archive from attacker infrastructure using a custom User-Agent header, extracts its contents to C:\ProgramData\f47f2a8c21c9df4e, silently launches a batch file named 1.bat, and prints fake Cloudflare verification text to keep the victim believing the check succeeded. The ClickFix social-engineering pattern is worth understanding on its own, because the fake-CAPTCHA lure is now a delivery mechanism for far more than commodity malware.

Technical Analysis

The ZIP (SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) contains two files: LockScreenContentServer.exe, a legitimate signed Windows binary, and dui70.dll, a malicious library masquerading as the Windows DirectUI Engine. Because the signed executable has a static import dependency on dui70.dll, the Windows loader resolves the attacker's copy from the application directory before the real one. Microsoft classifies the technique as DLL sideloading (MITRE ATT&CK T1574.001/.002). The malicious DLL decodes an embedded resource entirely in memory and transfers execution to it, never writing that stage to disk. Understanding how DLL sideloading abuses trusted binaries explains why an allowlist keyed on file signatures alone does not stop this stage.

The next stage retrieves PNG images from failover domains bestsocialmedianewspapper[.]com and offlineupdater[.]com and reconstructs an embedded binary from them using steganography: the extraction routine reads each pixel's RGBA channels, with the first 8 bytes encoding the payload length as a 64-bit integer. Three images are downloaded, the extracted fragments are concatenated, and the source images are deleted. Because the payloads move as ordinary image files, network inspection that looks for executable downloads sees nothing unusual.

Persistence is layered: a randomized HKCU Run key (entry name LockScreenContentServer_MuODG5yBM), a scheduled task that re-executes every 60 minutes, and attrib +h +s to hide the working directory as a system folder. The malware then runs bilingual reconnaissance (English, Spanish, and German locale variants of systeminfo filters) and enumerates the domain with nltest /domain_trusts, nltest /dclist:, net group "domain admins" /domain, and ADSI searches for user descriptions and computers, combined with a targeted ping sweep to locate domain controllers, databases, backup systems, gateways, and mail servers.

The final payload is client.py, a Python reverse-tunnel implant run via pythonw.exe from the official Python 3.14.5 embeddable distribution, so no window appears and no attacker-authored interpreter is dropped. It connects to gitnow[.]dev:443, upgrades to a TLS WebSocket at the /tunnel endpoint with certificate verification disabled (CERT_NONE), and rotates among four realistic browser User-Agent strings. Its custom 7-byte binary protocol (message type, stream ID, length) multiplexes streams and supports SOCKS5-style address parsing, letting the C2 server instruct the implant to reach any internal host and port. In effect, the compromised workstation becomes a proxy into the network. Recognizing the outbound behavior of a reverse-tunnel implant is often the most reliable way to catch this stage, because everything before it is designed to look legitimate.

Who Is Affected

Microsoft reports the campaign targeting organizations across multiple industries and did not attribute it to a named actor or disclose victim counts. The technique is platform-agnostic in spirit but this campaign targets Windows endpoints, and the domain-reconnaissance stage is built for Active Directory environments, where a single foothold can be pivoted across an internal network for the biggest payoff. Any organization whose users can open Windows Terminal or PowerShell and run unrestricted scripts is exposed to the initial-access stage.

Immediate Actions

The most effective control is preventing the paste-and-run step from ever executing. Microsoft recommends restricting PowerShell for standard users with AppLocker or App Control for Windows, blocking or auditing the Windows Run dialog, and creating an App Control policy that prohibits launching native Windows binaries from Run. Configure Windows Terminal to warn when pasted text contains multiple lines. Enforce PowerShell Constrained Language Mode, set execution policy to AllSigned or RemoteSigned, and enable script block logging to capture obfuscated commands.

For detection, alert on LockScreenContentServer.exe executing from any path other than C:\Windows\SystemApps, and hunt for pythonw.exe or python.exe command lines referencing client.py with --server, --uuid, cert.pem, and gitnow.dev. Block the network indicators gitnow[.]dev, bestsocialmedianewspapper[.]com, and offlineupdater[.]com. Enable Attack Surface Reduction rules that block obfuscated scripts and executables launched by script interpreters, and turn on network and web protection in Microsoft Defender for Endpoint. Microsoft Defender detections for the chain include Trojan:Win32/ClickFix.*, Trojan:Win64/DLLHijack.DAB!MTB, and Trojan:Python/Indigo.SA.

Long-Term Outlook

TerminalFix is a reminder that the user is now a scripted deployment step. As browsers and email gateways get better at blocking attachments and macros, adversaries increasingly ask the victim to run the payload themselves, and the fake CAPTCHA has become a trusted-looking wrapper for that request. Moving the instruction from the Run dialog to a full terminal is a small change with a large effect: it normalizes pasting multi-line scripts into a shell, a habit that defenders should treat as a policy problem, not just an awareness one. The durable fix is to remove the capability from standard users rather than to train them to resist it. Expect the fake-CAPTCHA-to-terminal pattern to keep spreading, and expect the payloads behind it to keep favoring living-off-the-land tooling (signed binaries, official interpreters, and ordinary-looking image files) precisely because those artifacts survive signature-based inspection.

Sources

• Microsoft Security Blog, "TerminalFix campaign deploys a reverse tunnel through multistage intrusion," 28 Aug 2026: https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• The Hacker News, "TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor," 28 Aug 2026: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html