Microsoft Threat Intelligence has detailed a TerminalFix campaign that turns a familiar user-verification pattern into a hands-on-keyboard intrusion path. The lure begins with a compromised website and a fake Cloudflare-style verification prompt, but the real objective is not a simple infostealer install. The campaign pushes the victim to run a PowerShell command, then builds a multistage chain that ends with persistence, Active Directory reconnaissance, and a reverse tunnel into the victim network.

That distinction matters. A fake CAPTCHA lure is easy to dismiss as user-awareness territory. A reverse tunnel sitting inside the network is a different problem: it can become an attacker-controlled path around perimeter defenses, VPN assumptions, and inbound firewall rules.

What Microsoft reported

The TerminalFix campaign is a ClickFix variant. Instead of only instructing users to open the Windows Run dialog, the lure directs them toward Windows Terminal or PowerShell so more complex commands are likely to execute correctly. The copied command masquerades as a verification step while downloading and launching the first stage from attacker infrastructure.

Microsoft observed a chain that uses a legitimate signed Windows binary, LockScreenContentServer.exe, as a DLL sideloading host. The attacker places a malicious dui70.dll beside it, causing the trusted process to load the attacker-controlled library. From there, the malware pulls additional payloads concealed inside PNG image files, reassembles them, establishes redundant persistence through registry Run keys and scheduled tasks, and performs domain reconnaissance.

The most important operational detail is the final capability: a Python-based reverse-tunnel implant that communicates over an encrypted WebSocket channel. Microsoft describes the tunnel as providing SOCKS-style TCP proxy access through the compromised host. In practical terms, the infected endpoint can become a beachhead for internal discovery and follow-on access.

Why this matters for SMBs and government contractors

Small and mid-sized organizations often rely heavily on outbound filtering, EDR, MFA, and remote-access controls, but do not always monitor workstations as potential proxy nodes. TerminalFix abuses that gap. The initial social engineering event happens at the user layer, but the value to the attacker comes from converting the endpoint into a routing point inside the environment.

For government contractors, the risk is broader than one infected laptop. If that host has access to file shares, ticketing systems, cloud admin portals, CUI repositories, development environments, or VPN-reachable enclaves, a reverse tunnel can let an external operator interact with internal systems as though they were sitting behind the firewall. The observed Active Directory enumeration also suggests the campaign is not content with commodity credential theft; it is preparing for environment-specific movement.

The fake verification pattern is also dangerous because it trains users to perform the attacker's execution step themselves. Traditional attachment controls may never see a malicious document. Web filtering may see a compromised legitimate site. Email security may only see a link. By the time the PowerShell command runs, the intrusion has moved from the browser into the endpoint and then toward the network.

Defensive takeaways

  • Hunt for user-launched PowerShell spawned from browsers. Prioritize PowerShell, Windows Terminal, cmd.exe, or scripting activity that follows browser interaction or clipboard-heavy workflows.
  • Monitor suspicious DLL sideloading patterns. A signed binary executing from unusual paths such as C:\ProgramData with adjacent DLLs should not inherit blind trust.
  • Block or alert on abnormal reverse tunnels. Look for long-lived outbound WebSocket sessions, SOCKS-like behavior, Python runtime execution from user or program-data paths, and unusual connections to newly registered domains.
  • Treat fake CAPTCHA reports as incident leads. If a user says a site told them to paste a command, assume code execution may already have occurred and preserve endpoint telemetry quickly.
  • Audit persistence in both registry and scheduled tasks. TerminalFix uses redundant persistence. Clearing only one mechanism may leave the host reinfecting itself.
  • Watch for Active Directory reconnaissance from workstations. Domain trust enumeration, domain admin discovery, user-description harvesting, and broad server ping sweeps from a normal endpoint deserve escalation.
  • Limit workstation reachability. Segmentation should prevent a compromised user endpoint from freely reaching management interfaces, servers, identity infrastructure, and sensitive file repositories.

Bulwark Black assessment

TerminalFix is a good example of why defenders should stop treating social engineering, endpoint malware, and network architecture as separate problems. The user gets tricked, the endpoint executes the payload, and the network design determines how much the attacker can do next.

The defensive win is not one silver bullet. It is friction at every stage: browser isolation for risky browsing, command-line telemetry, application control, DLL sideloading detection, egress filtering, reverse-tunnel hunting, and least-privilege network access from user workstations. The campaign is built to move across those seams. Defenders need visibility across the same seams.

For SMBs and government contractors, the near-term action is straightforward: review endpoint detections for fake-CAPTCHA execution patterns, confirm PowerShell and script logging are actually collected, and verify that ordinary user endpoints cannot become unrestricted internal proxies. A workstation compromise is bad. A workstation that can tunnel into the rest of the business is worse.

Original source: Microsoft Security — TerminalFix campaign deploys a reverse tunnel through multistage intrusion