Microsoft Warns of TerminalFix Attacks Using Reverse Tunnels
Microsoft alerts about a new variant of ClickFix attacks that use fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands in Windows Terminal. The attacks lead to a multi-stage intrusion chain resulting in a reverse tunnel into the vict…
Intelligence analysis by Qwen 2.5 (3B)
Microsoft warns of a new TerminalFix attack variant that uses fake CAPTCHA prompts to trick users into executing malicious PowerShell commands in Windows Terminal, leading to a reverse tunnel into the victim's internal network.
A new trick called TerminalFix uses fake CAPTCHA prompts to trick people into running bad code. This code hides in images and connects to a secret server to let the bad guys get into your computer's network.
Analysis
{"heading_1":"The TerminalFix Attack Variant","subheading_1":"Fake CAPTCHA Prompts","content_1":"The TerminalFix attack variant leverages fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands in Windows Terminal. The fake prompts instruct users to execute a PowerShell command preloaded into the clipboard as part of the purported verification process.","subheading_2":"Multi-Stage Intrusion Chain","content_2":"The attack employs a multi-stage intrusion chain, starting with a fake CAPTCHA prompt that downloads a ZIP archive containing a legitimate signed executable and a malicious DLL file. The malicious DLL file decodes and launches an obfuscated payload directly in memory.","subheading_3":"Steganography and Reverse Tunneling","content_3":"For the second stage, the threat actor uses steganography to hide executables and DLL fragments in the pixel data of three PNG images. The script downloads the image files from the command-and-control (C2) server and reassembles the embedded payloads on the disk. The malware establishes persistence through a scheduled task and a Registry Run key, configured to execute every hour. The most critical component is a custom Python reverse-tunnel module that connects to an outbound address (gitnow.dev:443) over an encrypted WebSocket, supporting SOCKS5-style arbitrary TCP proxying. This allows the attacker to instruct the compromised machine to connect to internal IPs, hostnames, and ports reachable from the victim."}
Key points
- TerminalFix uses fake CAPTCHA prompts to trick users into running bad code.
- The attack employs a multi-stage intrusion chain to gain access to internal networks.
- The malware establishes persistence and performs reconnaissance to identify vulnerable systems.
By improving security measures like monitoring PowerShell and hardening browsers, we can prevent these attacks from happening.
If the bad guys get into your computer, they can use it to spy on your network and steal your data.
