Microsoft Details TerminalFix ClickFix Campaign Using Fake CAPTCHA Prompts

Microsoft has described a ClickFix-style malware campaign it calls TerminalFix, which uses fraudulent Cloudflare CAPTCHA pages to persuade visitors to run malicious commands in Windows Terminal or PowerShell.

Unlike many ClickFix attacks that instruct targets to open the Windows Run dialog, this activity directs users to terminal applications. According to Microsoft, that approach can make it easier for attackers to execute longer and more complex scripts after a victim copies and pastes the displayed command.

Multi-stage infection chain

The campaign reportedly begins on compromised websites that present a counterfeit verification challenge. The prompt delivers a PowerShell command that downloads a ZIP file containing a legitimate executable, LockScreenContentServer.exe, alongside a malicious DLL named dui70.dll.

The attackers abuse DLL sideloading, causing the trusted executable to load the rogue library. The DLL then retrieves additional components concealed in PNG image files hosted on external domains. Microsoft said the malware establishes persistence through Registry Run keys and scheduled tasks before collecting information about the affected environment.

• System and domain details are gathered from the compromised device.
• The malware searches Active Directory for users, computers, domain administrators, and trust relationships.
• It can probe named systems to help map internal network connections.
• A PowerShell monitoring loop can read commands from a file, execute them, and save the output for retrieval.

Reverse-tunnel access

A key component is a Python-based backdoor identified as client.py. It creates an encrypted WebSocket connection to attacker-controlled infrastructure and can relay arbitrary TCP traffic through the infected host. This could allow an operator to access other systems reachable from the victim's network, effectively using the compromised endpoint as a proxy into the organization.

Microsoft warned that the combination of internal reconnaissance and reverse-tunneling capability could support lateral movement, privilege escalation, data theft, security-control evasion, or ransomware deployment.

Recommended defenses include limiting PowerShell and Windows Run dialog use for standard users through application-control policies, auditing for DLL sideloading behavior, enabling PowerShell script block logging, and training users to recognize fake verification prompts that ask them to paste commands into a terminal.