Full Report
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. [...]
Analysis Summary
# Tool/Technique: TerminalFix (ClickFix Variant)
## Overview
TerminalFix is a sophisticated variant of the "ClickFix" social engineering tactic. Unlike traditional ClickFix attacks that focus on immediate infostealer deployment, TerminalFix utilizes fake Cloudflare CAPTCHA prompts to trick users into executing PowerShell commands. Its primary purpose is to establish a persistent, multiplexed reverse tunnel into the victim's internal network to facilitate lateral movement and further exploitation.
## Technical Details
- **Type:** Malware Variant / Social Engineering Technique
- **Platform:** Windows
- **Capabilities:** Social Engineering, DLL Sideloading, Steganography, Persistence, Network Reconnaissance, Reverse Tunneling (SOCKS5 Proxy).
- **First Seen:** August 2026 (Reported)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1204.002 - User Execution: Malicious Link/Command
- **TA0003 - Persistence**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- T1547.001 - Boot or Target Architecture Social Engineering: Registry Run Keys / Startup Folder
- **TA0005 - Defense Evasion**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- T1027.003 - Obfuscation: Steganography
- **TA0007 - Discovery**
- T1018 - Remote System Discovery
- T1087.002 - Account Discovery: Domain Account
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling
- T1071.001 - Application Layer Protocol: Web Protocols (WebSockets)
## Functionality
### Core Capabilities
- **Clipboard Hijacking (Social Engineering):** Displays a fake CAPTCHA requiring the user to copy/paste a PowerShell command into Windows Terminal to "verify" their browser.
- **Multi-Stage Loading:** Downloads a ZIP archive containing a signed executable and a malicious DLL (DLL Side-loading) to execute an obfuscated in-memory payload.
- **Steganographic Extraction:** Retrieves three PNG files from a C2 and extracts malicious code hidden within pixel data to reassemble the final payload.
- **Network Reconnaissance:** Automatically probes for Domain Controllers, SQL databases, mail systems, and gateways while enumerating Active Directory.
### Advanced Features
- **Multiplexed Reverse Tunneling:** Uses a custom Python-based module to establish an encrypted WebSocket connection (`gitnow[.]dev:443`).
- **SOCKS5 Proxying:** Supports arbitrary TCP proxying, allowing the attacker to route traffic to internal IP addresses and hostnames through the victim's machine.
- **Evasive Communications:** Rotates realistic browser User-Agent strings and utilizes keepalive messages to maintain the connection and evade detection.
## Indicators of Compromise
- **File Names:** `LockScreenContentServer.exe` (when observed outside its normal Windows path).
- **Network Indicators:**
- `gitnow[.]dev` (C2 Domain)
- Port: `443` (WebSocket traffic)
- **Behavioral Indicators:**
- `PowerShell.exe` or `WindowsTerminal.exe` execution involving base64 encoded strings immediately following web browser activity.
- Unexpected creation of Scheduled Tasks or Registry Run keys pointing to user-writable directories.
- Large amounts of outbound WebSocket traffic to unrecognized domains.
## Associated Threat Actors
- **Unknown:** Specific groups have not been named, though the technique is a specialized evolution of the broader "ClickFix" campaigns typically associated with initial access brokers.
## Detection Methods
- **Behavioral Detection:** Monitor for instances of `LockScreenContentServer.exe` executing from paths other than `C:\Windows\System32\`.
- **PowerShell Monitoring:** Enable and monitor PowerShell Script Block Logging (Event ID 4104) for commands involving `Invoke-Expression` (IEX) or clipboard-related commands.
- **Network Inspection:** Detect non-browser processes initiating long-lived WebSocket connections to external domains.
## Mitigation Strategies
- **User Training:** Educate users that legitimate CAPTCHAs (like Cloudflare) never require manual execution of PowerShell commands or terminal inputs.
- **PowerShell Constrained Language Mode:** Implement Constrained Language Mode to limit the functionality of malicious scripts.
- **Endpoint Hardening:** Use Attack Surface Reduction (ASR) rules to block process creations originating from hijacked office or browser applications.
- **Credential Hygiene:** If TerminalFix is detected, assume network reconnaissance has occurred; rotate Domain Admin credentials and investigate for lateral movement.
## Related Tools/Techniques
- **ClickFix:** The original social engineering framework using fake browser update or "fix" prompts.
- **Chisel / Ligolo-ng:** Similar tools used for establishing reverse tunnels and SOCKS5 proxies.