TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor

What Happened

Microsoft security researchers have disclosed TerminalFix, a new variant of the ClickFix social-engineering technique that abandons the classic fake Windows Run-dialog lure for a more effective one: tricking victims into pasting and executing commands directly in Windows Terminal or PowerShell. Microsoft says the shift meaningfully increases success rates for delivering complex, multi-stage scripts compared to traditional ClickFix campaigns. The analysis, published August 28, 2026, was authored by Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan.

Campaign Details

How It Works

The Fake CAPTCHA Lure

Victims land on a compromised website presenting a fake Cloudflare CAPTCHA verification prompt. Rather than directing them to the Windows Run dialog, as classic ClickFix does, TerminalFix instructs the user to open Windows Terminal or PowerShell and paste a command — a step that looks more "technical" and plausible to targeted users, and gives the attacker a full shell environment to work with instead of the Run dialog's single-line limitation.

DLL Sideloading

The pasted PowerShell command downloads a ZIP archive containing a legitimate Windows binary, LockScreenContentServer.exe, alongside a malicious DLL named dui70.dll. When the legitimate executable loads, it inadvertently loads the attacker's DLL from the same directory — a classic DLL sideloading technique that lets the malicious code run under the guise of a trusted process.

Steganographic Payload Retrieval

Once loaded, dui70.dll reaches out to external domains and retrieves next-stage payloads hidden inside PNG image files using steganography, helping the traffic blend in with ordinary web requests and evade network-based detection that inspects for executable content.

The Reverse-Tunnel Backdoor

The final payload is a Python-based reverse-tunnel implant (client.py) that opens an encrypted WebSocket connection to attacker infrastructure at gitnow[.]dev:443. This tunnel lets the attacker route TCP traffic through the compromised host and reach deeper into the internal network, effectively turning the infected machine into a pivot point.

Post-Compromise Reconnaissance

Once established, the implant performs extensive enumeration of the environment, including system metadata collection, domain trust discovery, Active Directory admin and user/computer searches, and internal network topology mapping via DNS ping sweeps — reconnaissance consistent with preparation for lateral movement inside enterprise networks.

Impact Assessment

Recommendations

For Security Teams

• Restrict PowerShell execution using AppLocker or Group Policy, especially for standard user accounts that have no legitimate need to run arbitrary scripts.
• Enable PowerShell script block logging to capture command content for later investigation, not just the fact that PowerShell ran.
• Monitor for DLL sideloading indicators — legitimate binaries like LockScreenContentServer.exe executing from unusual directories alongside unsigned DLLs.
• Block or closely audit outbound connections to gitnow[.]dev and the identified malicious domains bestsocialmedianewspapper[.]com and offlineupdater[.]com.

For End Users

• Treat any prompt that asks you to open a terminal and paste a command to "verify you're human" as an automatic red flag — legitimate CAPTCHAs never require this.
• Report unexpected CAPTCHA prompts encountered on unfamiliar or unexpected sites to IT/security teams before interacting with them.

For Organizations

• Reinforce ClickFix awareness training, explicitly covering the terminal/PowerShell variant alongside the more widely known Run-dialog version.
• Review Registry Run keys and scheduled tasks for unfamiliar entries as part of routine endpoint hygiene checks.

Key Takeaways

1. TerminalFix is a ClickFix variant that lures victims into pasting commands into Windows Terminal or PowerShell instead of the Run dialog, increasing the success rate for complex payloads.
2. The infection chain uses DLL sideloading via a legitimate binary (LockScreenContentServer.exe) paired with a malicious dui70.dll.
3. Next-stage payloads are retrieved via steganography, hidden inside PNG images to evade detection.
4. The final payload is a Python reverse-tunnel implant that opens an encrypted WebSocket to gitnow[.]dev:443, enabling network pivoting.
5. Post-compromise behavior includes extensive Active Directory reconnaissance — domain trust discovery, admin enumeration, and network topology mapping.
6. Microsoft disclosed the campaign on August 28, 2026; defenders should restrict PowerShell execution and monitor for the identified IOCs.

Sources

• The Hacker News — TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor