Dettagli del blog

<p><strong>News Date: 2026-08-31</strong></p><p>A deceptive browser verification can now give attackers something more valuable than control of one computer. Microsoft has uncovered a ClickFix variant called TerminalFix that uses fake Cloudflare CAPTCHA prompts to convince victims to execute malicious commands in Windows Terminal or PowerShell.</p><h2>From Social Engineering to Network Access</h2><p>The attack begins when a compromised website presents what appears to be a routine human-verification request. Instead of completing a legitimate CAPTCHA, the visitor is instructed to paste and run a command that has already been copied to the clipboard. This action starts a multistage infection process.</p><p>The initial command downloads an archive containing a legitimate signed executable and a malicious DLL. The attackers then use steganography to conceal additional components inside image files. These components are extracted and assembled on the victim's system before persistence is established through a scheduled task and a Registry Run key.</p><p>TerminalFix subsequently searches for valuable internal assets, including domain controllers, databases, backup servers, mail systems and network gateways. It also collects system details and enumerates Active Directory.</p><h2>The Reverse Tunnel Changes the Risk</h2><p>The most concerning component is a custom Python module that creates an encrypted WebSocket connection to attacker infrastructure. This reverse tunnel supports arbitrary TCP proxying, allowing the compromised endpoint to act as a bridge into systems that are not directly exposed to the internet.</p><p>In my view, this is what separates TerminalFix from many ordinary information-stealing campaigns. The victim is not merely installing malware. The victim is unintentionally placing an attacker-controlled access point inside the corporate perimeter.</p><h3>Defensive Priorities</h3><ul><li>Restrict and log PowerShell and Windows Terminal activity where practical.</li><li>Alert when script interpreters launch from browsers or unusual parent processes.</li><li>Monitor outbound encrypted WebSocket connections to unfamiliar infrastructure.</li><li>Investigate unexpected scheduled tasks, Registry persistence and Python components.</li><li>Train employees never to paste commands supplied by websites.</li></ul><p>Organizations that confirm an infection should examine the wider environment for lateral movement and rotate credentials accessible from the affected endpoint. I believe security awareness programs must now treat requests to copy and execute commands as seriously as suspicious attachments. A polished CAPTCHA page should never be allowed to turn a user into the malware installer.</p>