Summary
- TerminalFix uses compromised websites and fake CAPTCHA overlays to persuade users to execute PowerShell commands.
- The chain uses DLL sideloading, steganographic payload delivery, persistence, and Active Directory reconnaissance.
- Microsoft observed a reverse WebSocket tunnel capable of proxying arbitrary TCP traffic through compromised endpoints.
Microsoft has documented a ClickFix variant that develops from a fake browser-verification prompt into a multistage intrusion capable of providing persistent network-level proxy access through a compromised Windows endpoint.
The campaign, which Microsoft calls TerminalFix, starts on compromised websites displaying a fake Cloudflare Turnstile verification overlay.
Instead of exploiting the browser, the page persuades the user to copy a command and execute it manually in Windows Terminal or PowerShell.
ClickFix campaigns have traditionally directed users towards the Windows Run dialog. Microsoft says TerminalFix moves the interaction into a terminal, allowing more complex and multi-line PowerShell commands to execute.
Once run, the command downloads a ZIP archive containing a legitimate signed Windows binary and a malicious DLL. The attacker then uses DLL sideloading, causing the trusted executable to load the malicious library from the same location.
The next stage retrieves additional components hidden within PNG images. Code extracts and reconstructs payloads from the image data before executing them on the host.
The malware establishes persistence using both a registry Run key and a scheduled task. Microsoft observed the scheduled mechanism configured to execute periodically, while installation files were marked with hidden and system attributes.
The intrusion then moves beyond the one-stage information-stealing behaviour commonly associated with ClickFix lures.
Microsoft observed extensive Active Directory and system reconnaissance, including domain-trust enumeration, discovery of domain administrators, user and computer enumeration, collection of system information, and attempts to identify reachable servers.
That activity provides a view of the wider corporate environment rather than the compromised endpoint alone. It can help an attacker establish whether a machine belongs to a domain, identify privileged identities, and locate infrastructure that may be reachable from the initial foothold.
The final component documented by Microsoft is a custom Python-based reverse tunnel. The malware deploys an embeddable Python runtime and establishes an encrypted WebSocket connection to attacker-controlled infrastructure.
The connection can relay arbitrary TCP traffic, effectively turning the infected endpoint into a proxy through which the attacker can reach systems from inside the victim network.
That changes the role of the compromised workstation. It is no longer simply a machine from which files or credentials can be collected; it becomes a network access point capable of carrying traffic towards internal services that may not be exposed directly to the internet.
Microsoft is careful about the downstream activity it actually observed. The tunnel creates capability for further access, but the company did not document every possible action that could follow from it.
Privilege escalation, lateral movement, data theft, or ransomware should therefore not be presented as confirmed consequences of TerminalFix merely because the tunnel could support them.
The campaign combines several legitimate mechanisms in ways that can complicate straightforward detection. A signed Windows executable is used for DLL sideloading, official Python components provide the runtime for tunnelling, encrypted WebSockets carry traffic, and initial command execution is performed by the user rather than through a software exploit.
The fake CAPTCHA remains the point at which the attack moves from a compromised website into the endpoint. What follows is considerably more substantial than a simple malware-download trick.
Persistence, Active Directory discovery, and reverse tunnelling turn a social-engineering interaction into a wider network problem, while the use of trusted components reduces the value of looking for a single obviously malicious executable.
Microsoft says it observed the campaign across multiple industries. The development shows ClickFix continuing to mature from an initial-access technique into a delivery mechanism for more complete enterprise intrusion chains.
