A new social engineering campaign is showing how a simple “I’m not a robot” check can turn into a serious enterprise compromise. Microsoft Threat Intelligence has uncovered a ClickFix variant dubbed TerminalFix, which uses fake Cloudflare CAPTCHA pages to trick users into executing malicious PowerShell commands. Unlike traditional ClickFix attacks that typically direct victims to the Windows Run dialog, TerminalFix pushes them toward Windows Terminal or PowerShell, giving attackers more room to execute complex, multi-stage commands.
The attack begins when a user lands on a compromised website displaying a convincing fake Cloudflare Turnstile verification overlay. After interacting with the fake CAPTCHA, the victim is instructed to copy and paste a command into Windows Terminal. What appears to be a harmless verification process actually downloads a ZIP archive containing a legitimate signed Windows executable, LockScreenContentServer.exe, alongside a malicious DLL named dui70.dll. The attackers then abuse DLL sideloading to make the trusted executable load their malicious code, helping the activity blend in with legitimate Windows processes.
From there, the intrusion becomes considerably more sophisticated. The malicious DLL launches PowerShell to retrieve PNG images containing hidden payloads using steganography, reconstructing additional malware on the compromised machine. The campaign also establishes persistence through Registry Run keys and scheduled tasks, allowing the malware to return even after a reboot. Once inside, it performs extensive Active Directory reconnaissance, including identifying domain trusts, administrators, users, computers and potentially valuable servers.
The most concerning part is what comes next: TerminalFix deploys a custom Python-based reverse-tunnel implant. It creates an encrypted WebSocket connection over TLS port 443 to attacker-controlled infrastructure, effectively allowing the attackers to proxy arbitrary TCP traffic through the compromised system. In practical terms, a single infected endpoint can become a gateway into the organization’s internal network. Microsoft notes that it did not observe the downstream activities described as potential consequences, such as lateral movement or ransomware deployment, in the analyzed chain.
The campaign is a reminder that attackers no longer need to exploit a complicated vulnerability to gain a foothold. Sometimes, convincing a user to complete a fake CAPTCHA is enough. For organizations, monitoring unusual PowerShell activity, DLL sideloading, unexpected executions of legitimate binaries, suspicious scheduled tasks and reverse-tunnel behavior is becoming increasingly important—while user awareness remains one of the strongest defenses against ClickFix-style attacks.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
