TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach Networks

A sophisticated ClickFix variant dubbed TerminalFix that uses fake Cloudflare CAPTCHA prompts to trick users into executing attacker-controlled PowerShell commands.

Rather than delivering a conventional infostealer, the campaign builds persistent access and deploys a reverse-tunnel implant capable of turning an infected Windows endpoint into a proxy for reaching internal network resources.

The intrusion begins on compromised websites displaying a convincing Cloudflare Turnstile-style “Verify you are human” overlay.

After a visitor interacts with the fake CAPTCHA, the site silently copies a malicious command to the clipboard and instructs the victim to open Windows Terminal or PowerShell and paste it.

This is the defining shift from traditional ClickFix behavior, which typically opens the Windows Run dialog. Directing victims to a terminal increases the chances that lengthy or multi-line scripts will run successfully.

The pasted PowerShell command impersonates a Cloudflare verification process with reassuring, color-coded status messages.

Behind the façade, it downloads a ZIP archive, extracts it into a hidden directory under C:\ProgramData, and launches a batch file.

The archive contains LockScreenContentServer.exe, a legitimate signed Windows binary, alongside a malicious DLL named dui70.dll.

The attackers abuse the binary’s dependency on dui70.dll to perform DLL sideloading, mapped to MITRE ATT&CK technique T1574.001.

Windows searches the application directory before System32 when resolving DLL dependencies, allowing the malicious DLL placed next to the legitimate executable to load first.

The resulting execution occurs inside a signed Microsoft-associated process, helping the attack blend into trusted activity and potentially evade controls based primarily on executable reputation.

The sideloaded DLL retrieves and decodes an obfuscated resource in memory, then triggers the next stage: payload delivery through PNG files.

One image carries an executable, while the other two contain separate fragments of a DLL that are reconstructed locally.

The use of image steganography complicates inspection because the payloads do not appear as conventional executable downloads while in transit.

The malware deletes the source images after extraction, further reducing forensic evidence.

TerminalFix also establishes redundant persistence. It creates an HKCU Run key and a scheduled task, both using a masquerading name associated with LockScreenContentServer, with the task configured to relaunch the payload every 60 minutes.

The malware additionally marks its directory as hidden and system-protected, an effort to make discovery through normal file browsing less likely.

After securing execution, the campaign performs extensive Active Directory and infrastructure reconnaissance.

TerminalFix Uses Fake CAPTCHA

Microsoft Threat Intelligence found that, TerminalFix downloads three images from attacker-controlled infrastructure and extracts hidden binary data from their pixel channels.

Microsoft observed domain trust discovery, domain administrator enumeration, user and computer searches, harvesting of Active Directory user descriptions, system metadata collection, and targeted ping sweeps against likely domain controllers, databases, backup servers, mail systems, and gateways.

This activity suggests the operators are assessing whether an infected endpoint can provide a useful route toward high-value enterprise assets.

A local file-watch mechanism offers an asynchronous command channel. The implant monitors a text file, executes newly written content through Invoke-Expression, and saves results to a separate output file.

More significantly, TerminalFix deploys an embeddable Python runtime and launches a custom client.py reverse-tunnel implant through pythonw.exe, keeping execution hidden from the user.

The implant connects to gitnow[.]dev over TLS on port 443, upgrades the session to WebSocket, and relays arbitrary TCP connections through a SOCKS5-style mechanism.

Its support for IPv4, IPv6, and hostname-based connections gives an operator the ability to access systems visible from the compromised device.

Microsoft noted that certificate verification is disabled and that the tunnel can multiplex multiple connections over a single encrypted WebSocket session.

TerminalFix is especially dangerous because it converts a user-driven social-engineering event into potential network-level access.

Microsoft did not observe downstream ransomware deployment, credential theft, or lateral movement in the analyzed chain.

However, organizations should regard affected machines as possible pivot points and investigate for exposed credentials, persistence, remote access activity, and suspicious connections to internal services.

Defenders should investigate unexpected execution of LockScreenContentServer.exe outside its normal C:\Windows\SystemApps location, especially from ProgramData.

Other high-signal artifacts include a co-located dui70.dll, hidden directories under C:\ProgramData, scheduled tasks or Run keys masquerading as Lock Screen components, and pythonw.exe launching unusual scripts.

Security teams should also hunt for PowerShell downloading archives or images from low-reputation domains, image-processing activity followed by executable creation, Invoke-Expression used in file-monitoring loops, and outbound TLS/WebSocket traffic associated with gitnow[.]dev.

Enabling PowerShell script block logging, application control, network protection, and attack surface reduction rules can improve visibility and reduce exposure.

Microsoft further recommends restricting unnecessary PowerShell usage, educating employees that legitimate CAPTCHA pages never require pasting commands into Terminal, and configuring Windows Terminal warnings for multi-line pasted text.

IOCs

Indicator	Description
18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f	Initial ZIP archive (verify_pkg.zip)
b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a	Custom tunnel implant (client.py)
ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07	Malicious DLL (dui70.dll)
026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab	Malicious DLL (dui70.dll)
032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22	Malicious DLL (dui70.dll)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide