Microsoft warns of TerminalFix attacks deploying reverse tunnels

Key Points:

• The TerminalFix variant of ClickFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal, enabling a multi-stage intrusion that grants attackers a reverse tunnel into internal networks.
• Unlike typical ClickFix attacks that deploy infostealer malware, TerminalFix directs users to Windows Terminal or PowerShell to execute complex scripts, ultimately downloading a ZIP archive with a signed executable and malicious DLL that runs an obfuscated payload in memory.
• The attack employs steganography to hide payload fragments in PNG images downloaded from a command-and-control server, establishes persistence through scheduled tasks and Registry keys, and performs extensive network reconnaissance including Active Directory enumeration.
• A custom Python reverse-tunnel module connects outbound over an encrypted WebSocket, allowing attackers to proxy connections into the victim’s internal network, effectively turning the infected machine into a pivot point for lateral movement and further exploitation.
• Microsoft recommends restricting and logging PowerShell execution, monitoring suspicious processes, hardening endpoint defenses, investigating lateral movement upon compromise, and rotating credentials, especially domain admin accounts accessible from the infected host.