TerminalFix Campaign Leverages Steganography and Reverse Tunnels for Deep Network Access
Microsoft details the TerminalFix campaign, a sophisticated multi-stage attack using compromised websites, steganography, and reverse tunnels to gain persistent network-level proxy access.
Microsoft Threat Intelligence has identified a new campaign dubbed "TerminalFix," which represents a significant evolution of the previously observed ClickFix malware family. This campaign targets organizations across various industries by employing a deceptive social engineering tactic: a fake Cloudflare CAPTCHA verification overlay presented on compromised websites. Unlike earlier ClickFix variants that typically directed users to the Windows Run dialog, TerminalFix campaigns specifically guide victims to Windows Terminal or PowerShell, increasing the likelihood of complex, multi-line scripts executing successfully.
The attack chain is notably sophisticated, moving beyond simple infostealer delivery. Upon user interaction with the fake CAPTCHA, a malicious PowerShell command is executed. This command downloads a ZIP archive containing a legitimate binary, LockScreenContentServer.exe, alongside a malicious DLL (dui70.dll). This pairing is designed for DLL sideloading, where the legitimate executable is tricked into loading the malicious DLL, initiating the subsequent stages of the attack.
A key innovation in TerminalFix is its use of steganography for payload delivery. The sideloaded DLL downloads PNG images from attacker-controlled domains. Embedded within the pixel data of these images are executable payloads and DLL fragments, which are then extracted and reassembled on the victim's system. This technique allows for the concealment of malicious code within seemingly innocuous image files, making detection more challenging.
To ensure persistence, the malware establishes footholds through both Registry Run keys and scheduled tasks. These mechanisms ensure that the LockScreenContentServer.exe binary is re-executed periodically, maintaining the attacker's presence on the compromised host. Following persistence, the campaign conducts extensive reconnaissance of the victim's Active Directory environment. This includes enumerating domain trusts, identifying domain administrators, harvesting user descriptions, and performing targeted server ping sweeps, often in both English and Spanish locales.
The ultimate goal of the TerminalFix campaign is to deploy a custom reverse-tunnel implant. This implant, written in Python, provides attackers with persistent, network-level proxy access. It establishes a SOCKS-style TCP proxy through an encrypted WebSocket channel to attacker infrastructure, allowing arbitrary traffic to be tunneled back through the compromised host. This capability grants attackers direct access to an organization's internal network, enabling further lateral movement and exploitation.
Microsoft emphasizes that organizations whose devices are affected by this campaign should treat them as potential pivot points for further attacks. The observed reconnaissance and tunneling capabilities could facilitate privilege escalation, disabling of security controls, data exfiltration, and ultimately, ransomware deployment across the network. The combination of stealthy techniques and persistent network access makes TerminalFix a significant threat to enterprise environments.
Defenders are advised to investigate for lateral movement and credential exposure on affected systems. Microsoft has provided indicators of compromise, detection details, and hunting guidance to assist security teams in identifying and responding to this evolving threat.