Full Report
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex
Analysis Summary
# Tool/Technique: TerminalFix
## Overview
TerminalFix is a sophisticated variant of the "ClickFix" social engineering technique. It employs fake Cloudflare CAPTCHA pages to trick users into copying and pasting malicious commands directly into Windows Terminal or PowerShell. The primary goal of this technique is to bypass browser-based download protections and execute multi-stage payloads that result in a persistent reverse-tunnel backdoor, giving attackers network-level proxy access to internal environments.
## Technical Details
- **Type:** Malware Variant / Social Engineering Technique
- **Platform:** Windows
- **Capabilities:** Social engineering, DLL sideloading, steganography, Active Directory reconnaissance, encrypted reverse-tunneling.
- **First Seen:** August 2026 (Disclosed by Microsoft)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (Compromised websites)
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1204.002 - User Execution: Malicious File (Copy-paste command execution)
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- T1027.003 - Obfuscation/Steganography: Steganography
- **TA0007 - Discovery**
- T1087.002 - Account Discovery: Domain Account
- T1482 - Domain Trust Discovery
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling
- T1071.001 - Application Layer Protocol: Web Protocols (WebSockets)
## Functionality
### Core Capabilities
- **Social Engineering:** Displays a fake Cloudflare "Verify You Are Human" CAPTCHA that instructs the user to press a key combination (implied) and paste a command into a terminal.
- **DLL Sideloading:** Uses a legitimate binary (`LockScreenContentServer.exe`) to load a malicious rogue DLL (`dui70.dll`).
- **Reverse Tunneling:** Deploys a Python-based implant (`client.py`) that establishes an encrypted WebSocket channel to bridge external C2 infrastructure with the internal network.
- **Reconnaissance:** Enumerates system metadata, Active Directory users, domain admins, and maps internal network topology via ICMP (ping).
### Advanced Features
- **Steganographic Extraction:** Retrieves next-stage payloads hidden within legitimate-looking PNG images to evade network traffic inspection.
- **Persistent Command Loop:** Maintains a PowerShell file-watch loop that monitors a local text file for new instructions, providing a secondary, low-noise execution mechanism.
- **Network Proxying:** The reverse tunnel acts as a proxy, allowing the C2 server to interact with any host visible to the compromised machine, facilitating lateral movement.
## Indicators of Compromise
- **File Names:**
- `LockScreenContentServer.exe` (Legitimate binary used for sideloading)
- `dui70.dll` (Malicious sideloaded DLL)
- `client.py` (Python reverse-tunnel implant)
- **Network Indicators:**
- `bestsocialmedianewspapper[.]com` (Payload delivery)
- `offlineupdater[.]com` (Payload delivery)
- `gitnow[.]dev:443` (C2 WebSocket infrastructure)
- **Behavioral Indicators:**
- Unexpected PowerShell execution originating from manual user input (Clipboard activity).
- Outbound encrypted WebSocket traffic to uncommon domains on port 443.
- Creation of Registry Run keys or Scheduled Tasks pointing to sideloaded binaries.
## Associated Threat Actors
- Unknown (Campaign identified by Microsoft security researchers).
## Detection Methods
- **Signature-based detection:** Monitor for the hash of the rogue `dui70.dll` and the Python `client.py` script.
- **Behavioral detection:**
- Audit terminal/PowerShell processes that exhibit heavy Active Directory enumeration commands (e.g., `Get-ADUser`, `net group "Domain Admins"`).
- Detect anomalous loads of `dui70.dll` by processes other than their legitimate Windows parents.
- Monitor for high-frequency file-read loops by PowerShell processes.
- **Logging:** Enable **PowerShell Script Block Logging (Event ID 4104)** to capture the de-obfuscated commands pasted by the user.
## Mitigation Strategies
- **Attack Surface Reduction:** Use AppLocker or Windows Defender Application Control (WDAC) to restrict PowerShell execution to signed scripts only.
- **Access Control:** Restrict the ability of standard users to access the Windows Run dialog or administrative command-line interfaces where feasible.
- **Endpoint Hardening:** Monitor for DLL sideloading in common directories.
- **User Education:** Train employees to never copy and paste commands from a website directly into a terminal or PowerShell prompt, regardless of the site's apparent legitimacy.
## Related Tools/Techniques
- **ClickFix:** The predecessor technique focusing on the Windows Run dialog (`Win+R`).
- **Chisel / Ligolo-ng:** Similar tools used for establishing reverse tunnels and network pivoting.