Microsoft warns of TerminalFix attacks deploying reverse tunnels

Summary

Microsoft has identified a new malware variant called TerminalFix, which is a variant of ClickFix. It uses deceptive Cloudflare CAPTCHA prompts on compromised websites to trick users into executing malicious PowerShell commands. This campaign goes beyond typical infostealer infections by establishing a reverse tunnel into the victim's internal network, enabling further malicious activities.

Full text

Microsoft warns of TerminalFix attacks deploying reverse tunnels By Bill Toulas August 31, 2026 02:51 PM 0 A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands in Windows Terminal. Unlike typical ClickFix attacks that often lead to infostealer malware infections, this campaign uses a multi-stage intrusion chain that ultimately gives attackers a reverse tunnel into the victim’s internal network. TerminalFix differs from normal ClickFix attacks in that it directs users to Windows Terminal or PowerShell, which enables successful execution of more complex, multi-line scripts. Microsoft discovered the attacks in the wild but did not observe hands-on activity. However, the researchers warn that access obtained this way could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or deploying ransomware. The infection begins with a fake CAPTCHA prompt that instructs victims to execute a PowerShell command preloaded into the clipboard as part of the purported verification process. The ClickFix stepSource: Microsoft The command downloads a ZIP archive that contains a legitimate signed executable and a malicious DLL file, which decodes and launches an obfuscated payload directly in memory. For the second stage, the threat actor used steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads the image files from the command-and-control (C2) server and reassembles the embedded payloads on the disk. Retrieving code from three steganographic imagesSource: Microsoft The malware establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour. While active, it performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems; collecting system information; and enumerating Active Directory (AD). The most important component is a custom Python reverse-tunnel module that connects to an outbound address (gitnow[.]dev:443 ) over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying. This allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim. Establishing a reverse-tunnelSource: Microsoft The reverse-tunnel also supports multiplexing multiple connections over one WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown. Microsoft says this can turn the infected endpoint into a network pivot, giving the operator a route to systems discovered during the earlier AD and network reconnaissance operation. The researchers recommend restricting and logging PowerShell execution, monitoring ‘LockScreenContentServer.exe’ outside its normal path, and hardening browsers and endpoint protections. If compromise is confirmed, it is advisable to investigate for lateral movement and to rotate credentials, including domain admin credentials, if accessible from the infected host. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Hackers abuse npm mirrors to host phishing redirect pagesNew Infinity Stealer malware grabs macOS data via ClickFix luresDDoS attacks over 1 Tbps surged fivefold in the second quarterNew DOUBLECUP ClickFix service hides malware in browser cache imagesESET tracks rise in malicious AI skills and adaptable malware

Indicators of Compromise

• domain — gitnow[.]dev

Entities