Microsoft Warns of 'TerminalFix' ClickFix Variant Using Reverse Tunnels for Network Intrusions

Microsoft has discovered a threat campaign utilizing a new ClickFix attack variant designed to deploy reverse tunnels, providing attackers with unauthorized access to victims' internal networks.

The attack, dubbed 'TerminalFix' by researchers, begins with a fake CAPTCHA prompt displayed on compromised websites. Victims are instructed to execute a PowerShell command that has been pre-loaded into their clipboard as part of a purported verification process. Unlike typical ClickFix attacks that often lead to infostealer malware infections, this campaign directs users to Windows Terminal or PowerShell, enabling the execution of more complex, multi-line scripts.

The initial command downloads a ZIP archive containing a legitimate signed executable and a malicious DLL file. The DLL decodes and launches an obfuscated payload directly in memory. For the second stage, attackers employ steganography to hide executables and DLL fragments within the pixel data of three PNG images. The script downloads these images from a command-and-control (C2) server and reassembles the embedded payloads on disk.

Persistence is established through a scheduled task and a Registry Run key, configured to execute every hour. Once active, the malware performs reconnaissance by probing for domain controllers, databases, backup servers, gateways, and mail systems, while also collecting system information and enumerating Active Directory.

A core component of the attack is a custom Python reverse-tunnel module that connects to an outbound address over an encrypted WebSocket. This module supports SOCKS5-style arbitrary TCP proxying, allowing the attackers to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim. The reverse tunnel also supports multiplexing for multiple concurrent connections.

Microsoft has cautioned that while hands-on activity was not directly observed, access obtained through this method could be leveraged for lateral movement, privilege escalation, credential theft, disabling security tools, data exfiltration, or deploying ransomware.

Why This Matters

This attack bypasses traditional security measures by using legitimate Windows components (Terminal, PowerShell) for execution, making it harder for typical endpoint defenses to detect.
The use of steganography in PNG images for payload delivery adds a layer of obfuscation that standard security tools may not flag.
The reverse-tunnel capability allows attackers to pivot from an initial endpoint into broader internal networks, potentially compromising critical infrastructure such as domain controllers and databases.

Background

ClickFix attacks are a type of social engineering tactic where victims are prompted to click a button that, instead of verifying identity, executes malicious code. They often employ fake CAPTCHA or error message interfaces. This particular variant, TerminalFix, represents an evolution of that technique, specifically targeting Windows Terminal to execute multi-line scripts, which are more complex and capable compared to typical ClickFix payloads.

Key Perspectives

Security researchers: Microsoft's threat intelligence team views this as a significant escalation in ClickFix capabilities, noting the multi-stage intrusion chain and reverse-tunnel functionality. They emphasize the potential for severe downstream impacts, including lateral movement and ransomware deployment. Enterprise defenders: The attack's use of steganography and encrypted WebSocket communications poses detection challenges. Organizations may need to update monitoring rules to flag unusual PowerShell activity and outbound connections on non-standard ports. Victim organizations: Compromised systems may not show immediate signs of infection, as the initial stage is designed to be stealthy. The reconnaissance and reverse-tunnel capabilities mean that even a single compromised endpoint could lead to broader network compromise.

What to Watch

Detection of fake CAPTCHA prompts on legitimate compromised websites, particularly those associated with Cloudflare services.
Unusual PowerShell or Windows Terminal execution events in enterprise environments, especially those triggered by web browsing.
Outbound network traffic from internal systems to new or unknown domains, particularly on port 443 using WebSocket connections.
Organizations reporting lateral movement or unusual AD enumeration activity that may originate from user workstations.

ZOTPAPER