Cybersecurity researchers at **Microsoft** have uncovered a potent new threat, **TerminalFix**, which represents an evolution of the **ClickFix** attack chain. This variant is designed to create a reverse tunnel into compromised internal networks, marking a significant escalation in attacker capabilities. ### Deceptive Entry Point The attack initiates with a deceptive **Cloudflare** CAPTCHA prompt on compromised websites. Victims are instructed to copy and paste a pre-loaded PowerShell command into **Windows Terminal** or PowerShell as part of a purported verification process. .jpg) This method differs from typical **ClickFix** attacks, which often lead to infostealer infections. By directing users to **Windows Terminal** or PowerShell, **TerminalFix** enables the execution of more complex, multi-line scripts, facilitating a multi-stage intrusion chain. ### Multi-Stage Payload Delivery and Steganography Upon execution, the PowerShell command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL. This DLL decodes and launches an obfuscated payload directly in memory. In a more advanced second stage, the threat actors employ steganography. Malicious executables and DLL fragments are hidden within the pixel data of three PNG images. The script downloads these image files from the command-and-control (C2) server and reassembles the embedded payloads on the victim's disk.  ### Persistence and Reconnaissance To ensure continued access, the malware establishes persistence through a scheduled task and a Registry Run key, configured to execute hourly. Once active, **TerminalFix** performs extensive reconnaissance, probing for domain controllers, databases, backup servers, gateways, and mail systems. It also collects system information and enumerates **Active Directory** (AD). ### The Reverse Tunnel: A Gateway to Internal Networks The most critical component of **TerminalFix** is a custom Python reverse-tunnel module. This module connects to an outbound address (gitnow[.]dev:443) over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying.  This reverse tunnel allows attackers to instruct the compromised machine to connect to any internal IPs, hostnames, and ports reachable from the victim's network. The tunnel also supports multiplexing multiple connections over a single WebSocket, rotating realistic browser User-Agent strings, keepalive, and remote shutdown capabilities. **Microsoft** warns that this functionality can transform the infected endpoint into a network pivot, providing attackers with a direct route to systems discovered during the initial AD and network reconnaissance. ### Mitigation and Response To counter **TerminalFix** and similar threats, **Microsoft** recommends several key security measures: * **Restrict and Log PowerShell Execution**: Implement strict policies and comprehensive logging for PowerShell activity. * **Monitor 'LockScreenContentServer.exe'**: Watch for instances of this executable running outside its normal path. * **Harden Browsers and Endpoint Protections**: Ensure browsers are up-to-date and configured securely, and endpoint detection and response (EDR) solutions are robust. In the event of a confirmed compromise, it is crucial to investigate thoroughly for lateral movement and to rotate all accessible credentials, including **domain admin credentials**, if the infected host had access to them.