A New Twist on an Old Social Engineering Trick
Microsoft has published details on TerminalFix, a variant of the ClickFix technique that has become one of the most common initial access methods across the threat landscape over the past two years. Traditional ClickFix campaigns direct victims to the Windows Run dialog and ask them to paste and execute a short command, usually under the pretext of completing a verification step. TerminalFix applies the same social engineering hook but redirects victims to Windows Terminal or PowerShell instead, which Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan say increases the odds that longer, more complex, multi-line scripts execute successfully.
The lure itself is a fake Cloudflare CAPTCHA verification page served from compromised, otherwise legitimate websites. A visitor who clicks through the fake verification is prompted to copy a command and paste it into Terminal or PowerShell to prove they are human, a framing that continues to work because it mimics a routine, low-friction interaction millions of people encounter every day. Microsoft says the campaign is targeting organizations across multiple sectors rather than a single industry, which points to opportunistic compromise of websites rather than a narrowly targeted operation.
From a Pasted Command to a Reverse Tunnel
Once executed, the PowerShell command downloads a ZIP archive containing a legitimate signed binary, LockScreenContentServer.exe, packaged alongside a malicious DLL named dui70.dll. Placing the two together triggers a classic DLL sideloading attack, letting the malicious code run under cover of a trusted, signed process. The sideloaded DLL then reaches out to external domains, including bestsocialmedianewspapper[.]com and offlineupdater[.]com, to retrieve next-stage payloads that are hidden inside ordinary-looking PNG images using steganography, a technique designed specifically to slip past network content inspection that only checks for known malicious file types.
The DLL establishes persistence through both Registry Run keys and scheduled tasks, then performs domain reconnaissance before deploying its real payload, a Python-based reverse-tunnel implant named client.py. That implant tunnels arbitrary TCP traffic back to attacker infrastructure at gitnow[.]dev over an encrypted WebSocket channel, effectively giving the command-and-control server the ability to reach any host visible from the compromised machine's own network position. A persistent PowerShell file-watch loop rounds out the toolkit, monitoring a text file for new commands and executing them through Invoke-Expression.
Reconnaissance Built for Lateral Movement
TerminalFix does not stop at establishing a foothold. Microsoft's analysis describes an active Active Directory reconnaissance phase that collects system metadata, performs domain trust discovery, enumerates domain administrators, and searches Active Directory for users and computers. The implant also pings named servers across the environment to map internal network topology, building the kind of reconnaissance picture an attacker would normally need hands-on-keyboard access to assemble. Automating that phase inside the initial payload compresses the time between a single employee's misplaced click and a working map of the target's internal network.
That combination, a persistent reverse tunnel plus automated internal reconnaissance, is what makes TerminalFix more dangerous than a typical infostealer drop. Microsoft's own assessment is direct about the stakes: "This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel." The company adds that the observed reconnaissance and tunnel capability could let an attacker identify and reach additional systems from the single compromised host, turning one bad click into a foothold across an entire segment of the network.
Why Enterprises Should Treat This as a Ransomware Precursor
Microsoft explicitly frames the reverse-tunnel access as a springboard rather than an endpoint in itself, warning that it can be abused to escalate privileges, disable security controls, exfiltrate sensitive data, and ultimately deploy ransomware. That framing matches a pattern security teams have watched play out repeatedly over the past several years, where a single-user social engineering compromise becomes the entry point for a full domain-wide ransomware event weeks later, after attackers have used the initial access to quietly map and prepare the environment for maximum impact.
The gap between a fake CAPTCHA and a domain-wide encryption event is measured in reconnaissance time, and TerminalFix is built to compress that window. Organizations that treat ClickFix-style lures as a nuisance rather than a serious initial access vector are underestimating how much capability a modern variant like this one packs into a single copy-paste interaction, particularly when that interaction routes through Terminal or PowerShell rather than the more heavily monitored Run dialog that most detection tooling was originally built around.
Practical Defenses Microsoft Recommends
Microsoft's mitigation guidance starts with restricting execution paths rather than relying on users to spot the lure. That means restricting PowerShell and Run dialog execution for standard users through AppLocker, Application Control for Windows, or Group Policy, and considering an outright block or audit of the Windows Run dialog itself where it is not required for day-to-day work. Enterprises should also monitor for DLL sideloading indicators specifically, since that step is the pivot point where a signed, trusted binary is used to launder execution of the malicious payload.
On the detection side, Microsoft recommends enabling PowerShell script block logging to catch obfuscated or encoded commands before they run, since the initial paste-and-run step is the highest-leverage point to intercept the entire chain before DLL sideloading, steganographic payload retrieval, and reverse-tunnel deployment ever begin. Employee training that specifically addresses ClickFix-style lures, rather than generic phishing awareness, remains a meaningful control given how much this technique depends on victims believing they are completing a routine verification step rather than executing attacker-supplied code.
