Published on August 29, 2026
Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel
Severity
Medium
Detail
Microsoft has documented TerminalFix, a social engineering campaign that tricks users into executing malicious PowerShell commands via fake Cloudflare CAPTCHA prompts.
Moving beyond basic ClickFix tactics, TerminalFix directs victims to paste code directly into Windows Terminal. By combining DLL sideloading, image steganography, and an embedded Python reverse tunnel, the campaign converts compromised endpoints into internal network pivot points.
How?
The attack relies on compromised websites displaying a fake “Verify you are human” overlay. Clicking the prompt silently copies a malicious command to the user’s clipboard and instructs them to paste it into Windows Terminal. Once executed, the command downloads a ZIP payload into a hidden ProgramData directory.
To evade detection, the malware uses DLL sideloading by pairing a legitimate, Microsoft-signed binary (LockScreenContentServer.exe) with a rogue DLL (dui70.dll). The signed binary loads the malicious DLL, executing a secondary PowerShell script. This script downloads harmless-looking PNG images and uses steganography to extract hidden executable code from their pixels, establishing persistence via Registry Run keys and scheduled tasks every 60 minutes.
After conducting Active Directory reconnaissance to map out domain controllers and backup systems, the malware deploys an embedded Python environment (pythonw.exe). It executes a custom script (client.py) that opens an outbound WebSocket connection to gitnow[.]dev. This establishes a SOCKS5-style reverse tunnel, enabling attackers to route arbitrary TCP traffic deep into the internal network.
Conclusion
TerminalFix demonstrates how attackers weaponize user actions to bypass perimeter defenses and hide behind legitimate system binaries. Defense requires blocking unauthorized script execution and enforcing strict user verification rules.
Defensive Recommendations & Mitigation Guidance:
- User Awareness: Train employees that no legitimate CAPTCHA will ever ask them to paste commands into a terminal.
- Limit Terminal Access: Enforce AppLocker or WDAC to restrict PowerShell and Windows Terminal execution for standard users.
- Detect Sideloading: Monitor EDR alerts for LockScreenContentServer.exe running outside of C:\Windows\SystemApps.
- Script Telemetry: Enable PowerShell Script Block Logging (Event ID 4104) and inspect hidden subfolders in ProgramData.
- Network Surveillance: Flag unapproved pythonw.exe activity and outbound WebSocket connections to untrusted domains like gitnow[.]dev.
Source