TerminalFix: Fake Cloudflare CAPTCHAs now use Windows Terminal to install a reverse-tunnel backdoor

Microsoft has documented a new variant of the ClickFix family, called TerminalFix, that shifts the deception from the classic Windows Run dialog to Windows Terminal or PowerShell. The analysis, published on August 28, 2026 and signed by researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan, describes a multi-stage campaign that starts from compromised sites and distributes a backdoor with reverse tunnel functionality into the internal network of affected organizations. The threat is considered serious for enterprise environments.

The deception moves from Run to Windows Terminal

The TerminalFix campaign targets organizations across multiple sectors through compromised websites that display fake Cloudflare CAPTCHAs. The visitor is tricked into copying and pasting a PowerShell command, believing they need to complete an anti-bot verification. ClickFix is a family of attacks based on user deception: the victim sees a message prompting them to perform a manual action, usually pasting a command, to solve a fake problem.

The difference from traditional ClickFix lies in the execution surface: no longer the Run dialog (Win+R), but Windows Terminal or PowerShell. According to Microsoft, this change increases the likelihood that complex, multi-line scripts are executed correctly, bypassing the limitations of the Run dialog. Specific affected Windows versions have not been disclosed: the vector exploits standard operating system components and does not require product vulnerabilities.

The infection chain: from pasted command to DLL sideloading

The PowerShell command executed by the victim downloads a ZIP archive containing two files: LockScreenContentServer.exe, a legitimate binary, and dui70.dll, a malicious library. When the executable is launched, the system loads the malicious DLL from the same path via DLL sideloading. In this way, the malicious code runs within the context of an apparently legitimate application, evading many security controls.

The library then retrieves subsequent payloads hidden inside PNG images from the domains bestsocialmedianewspapper[.]com or offlineupdater[.]com. Persistence is ensured via Registry Run keys and scheduled tasks, so the malware survives reboots.

Active Directory reconnaissance and reverse tunnel to gitnow[.]dev

Once installed, the malware performs deep Active Directory reconnaissance. It collects system metadata, identifies domain trusts, enumerates domain admins, searches for AD users and computers, and uses ping to known servers to map the internal network topology. The goal is to identify high-value targets and lateral movement paths.

Then client.py is deployed, a Python backdoor with reverse tunnel functionality. The component channels arbitrary TCP traffic to gitnow[.]dev on port 443 through an encrypted WebSocket channel. In practice, the compromised machine acts as a proxy: the command-and-control server can reach any host visible from the victim's network, even if not exposed to the Internet. The reverse tunnel allows the attacker to bypass perimeter controls and reach internal services that normally are not reachable from outside.

A PowerShell file-watch loop is also installed that monitors a text file, executes new commands via Invoke-Expression and writes results to an output file, ensuring a persistent channel for remote execution.

Why TerminalFix is particularly dangerous

This is not a product vulnerability with a CVE identifier or a CVSS score. Consequently, the campaign does not appear in the CISA KEV catalog, which collects vulnerabilities exploited in active attacks. It is instead a chain of social engineering, code execution and network-level proxy access.

Microsoft considers it particularly dangerous because the reverse tunnel gives the attacker direct access to the organization's internal network. From that position they can attempt privilege escalation, disable security controls, exfiltrate sensitive data or distribute ransomware. Since there is no software fix to deploy, protection depends entirely on reducing the attack surface and monitoring indicators.

Indicators of compromise

Those defending a network can look for these indicators:

• Domains: bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev (port 443)
• Files: LockScreenContentServer.exe, dui70.dll, client.py
• Techniques: DLL sideloading, payloads hidden in PNG images, execution via Invoke-Expression, encrypted WebSocket to gitnow[.]dev:443

The presence of network traffic to the indicated domains, processes loading dui70.dll from non-standard paths, or PowerShell commands using Invoke-Expression should trigger immediate investigation.

How to defend

There are no patches to apply, because there is no single flaw to fix. The recommended countermeasures are configuration and monitoring:

• Restrict PowerShell and Run dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy.
• Consider blocking or auditing the Run dialog (Win+R) if it is not needed for daily tasks.
• Monitor indicators of DLL sideloading, especially the loading of dui70.dll from non-standard directories.
• Train employees to recognize ClickFix attacks: no legitimate CAPTCHA asks to open a terminal and paste commands.
• Enable PowerShell Script Block Logging to detect and analyze obfuscated or encoded commands.

These measures reduce the attack surface and increase the ability to detect an ongoing infection. TerminalFix demonstrates that attackers continue to refine social engineering techniques, shifting the deception to tools that enterprise users use every day.