{"id":2608,"date":"2026-08-30T09:23:45","date_gmt":"2026-08-30T09:23:45","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2608"},"modified":"2026-08-30T09:23:45","modified_gmt":"2026-08-30T09:23:45","slug":"terminalfix-uses-fake-cloudflare-captchas-to-deploy-reverse-tunnel-backdoor","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2608","title":{"rendered":"TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 30, 2026<\/span><\/span>Social Engineering \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix<\/strong>, that aims to trick users into running a malicious command in Windows Terminal or PowerShell.<\/p>\n

\u00abWhile traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully,\u00bb Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan said<\/a> in an analysis published this week.<\/p>\n

The campaign, targeting organizations across multiple sectors, leverages compromised websites as a starting point to serve fake Cloudflare CAPTCHA verifications that prompt unsuspecting site visitors to copy and execute a malicious PowerShell command.<\/p>\n

The attack chain, per the Windows maker, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke custom reverse-tunnel implant that grants the attacker persistent, network-level proxy access through the infected machine.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Specifically, the PowerShell command is designed to download a ZIP archive containing a legitimate binary (\u00abLockScreenContentServer.exe\u00bb) and a rogue DLL (\u00abdui70.dll\u00bb) in order to initiate a DLL sideloading attack.<\/p>\n

<\/p>\n

The sideloaded DLL is responsible for retrieving next-stage payloads hidden within PNG images from external domains (\u00abbestsocialmedianewspapper[.]com\u00bb or \u00abofflineupdater[.]com\u00bb), establishes persistence via both Registry Run keys and scheduled tasks, carries out domain reconnaissance, and then deploys a Python-based reverse-tunnel command-and-control (C2) implant.<\/p>\n

The backdoor (\u00abclient.py\u00bb) is equipped to tunnel arbitrary TCP traffic back to attacker-controlled infrastructure (\u00abgitnow[.]dev:443\u00bb) through an encrypted WebSocket channel, as well as enable the C2 server to reach any host visible from the victim’s network.<\/p>\n

The reconnaissance phase involves the following steps –<\/p>\n