**Microsoft** has revealed details about **TerminalFix**, an evolved version of the **ClickFix** malware. Unlike its predecessors, which guided victims to the Windows Run dialog, **TerminalFix** directs users to **Windows Terminal** or **PowerShell**, significantly increasing the success rate of executing complex, multi-line scripts. "While traditional **ClickFix** campaigns direct victims to the Windows Run dialog, **TerminalFix** campaigns apply the same technique but direct users to **Windows Terminal** or **PowerShell** instead, increasing the likelihood that complex, multi-line scripts execute successfully," explained **Microsoft** security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan in their recent analysis. ### Sophisticated Attack Chain Unveiled The campaign targets organizations across various sectors, initiating with compromised websites. These sites serve deceptive **Cloudflare** CAPTCHA verifications, prompting unsuspecting visitors to copy and execute a malicious PowerShell command. **Microsoft** describes the attack as a sophisticated multi-stage process. It involves **DLL sideloading**, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant. This implant provides attackers with persistent, network-level proxy access through the infected machine. ### Technical Breakdown of the Intrusion Specifically, the PowerShell command downloads a ZIP archive containing a legitimate binary (**LockScreenContentServer.exe**) and a rogue DLL (**dui70.dll**). This combination initiates a **DLL sideloading** attack. The sideloaded DLL then retrieves subsequent payloads hidden within PNG images from external domains such as `bestsocialmedianewspapper[.]com` or `offlineupdater[.]com`. It establishes persistence through both Registry Run keys and scheduled tasks, conducts domain reconnaissance, and finally deploys a Python-based reverse-tunnel command-and-control (C2) implant. The backdoor, identified as `client.py`, is designed to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure (`gitnow[.]dev:443`) via an encrypted **WebSocket** channel. This allows the C2 server to reach any host visible from the victim's network. ### Reconnaissance and Persistence Tactics The reconnaissance phase is comprehensive, including: * Collection of system metadata. * Domain trust discovery, domain admin enumeration, and Active Directory user and computer searches. * Pinging named servers to map the internal network topology. The attack also incorporates a persistent PowerShell file-watch loop. This loop monitors a text file for new commands, executes them using `Invoke-Expression`, and writes the results to an output file. ### Grave Implications for Enterprise Environments **Microsoft** warns that this type of intrusion is particularly dangerous. "This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel," **Microsoft** stated. "The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host." Such access can be exploited for privilege escalation, disabling security controls, exfiltrating sensitive data, and deploying ransomware, positioning **TerminalFix** as a significant threat to enterprise environments. ### Mitigation Strategies To counter the **TerminalFix** threat, organizations are advised to: * Restrict PowerShell and Run dialog execution for standard users using **AppLocker**, **Application Control for Windows**, or Group Policy. * Consider blocking or auditing the Windows Run dialog (**Win+R**) if not essential. * Monitor for indicators of **DLL sideloading**. * Educate employees about **ClickFix** attacks. * Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands.