TerminalFix Turns Fake CAPTCHAs into Tunnels into Corporate Networks

Microsoft Observes a New Evolution of ClickFix Attacks

On August 31, 2026, Microsoft reported an active cyber campaign based on a variant of the ClickFix technique known as TerminalFix.

The attack begins with fake CAPTCHA checks displayed on compromised websites. The page persuades the victim to open Windows Terminal and run a PowerShell command already placed in the clipboard, presenting it as necessary to complete the verification.

No software vulnerability is exploited. The user initiates the chain by following instructions designed to resemble a standard anti-bot procedure. As a result, there are no associated CVE identifiers, CVSS scores, security updates, or specific Windows versions affected.

The operation differs from more common ClickFix campaigns, which often focus on installing infostealers. In this case, the primary outcome is a reverse tunnel that allows the operators to use the compromised computer as an entry point into the internal network.

Microsoft did not observe interactive sessions after the compromise. However, the access obtained is consistent with reconnaissance, lateral movement, credential theft, defense evasion, data exfiltration, and ransomware deployment.

From the PowerShell Command to the In-Memory Payload

The chain begins when the fake CAPTCHA tricks the victim into executing the PowerShell command stored in the clipboard. This step helps bypass some browser defenses because the action is explicitly authorized by the user in a Windows terminal.

The command downloads a ZIP archive containing two items:

• a legitimate executable with a valid digital signature;
• a malicious DLL intended to be loaded through that executable.

Using a signed program may reduce user suspicion and complicate checks based solely on the reputation of the main file. The DLL, however, performs the malicious operations: it decodes the obfuscated payload and launches it directly in memory.

This structure requires more thorough inspection than simply validating the digital signature. A signed file does not guarantee that the entire loading sequence is trustworthy, especially when unexpected libraries are located alongside it in directories created after a download.

TerminalFix also takes advantage of the greater flexibility of Windows Terminal and PowerShell compared with simple Run dialog windows. Scripts can contain multiple instructions, handle downloads, and reconstruct complex components without showing the victim the full logic of the attack.

The affected Windows builds and exact versions of Windows Terminal or PowerShell were not disclosed. No single initial path from which the downloaded material is executed has been identified either.

Three PNG Images Hide Executables and DLL Fragments

The second stage uses steganography to conceal parts of the malware inside three PNG images. Executable files and DLL fragments are embedded in pixel data, allowing them to appear as ordinary graphic content during transfer.

A script downloads the three images from the command-and-control server, extracts the hidden data, and reconstructs the required components on disk. The final payload therefore does not need to be transferred as a single, immediately recognizable executable.

This technique fragments the chain and may hinder controls that analyze each download in isolation. A single image may not appear suspicious unless its later use is correlated with file access, pixel-data processing, and the creation of DLLs or executable programs.

To maintain access, the malware establishes two different forms of persistence:

• a Windows scheduled task configured to run hourly;
• a Registry Run key, also associated with recurring execution.

This redundancy allows the compromise to survive the removal of either mechanism. For analysts, scheduled tasks and Run keys created or modified within the same time frame should therefore be correlated.

One component requiring investigation is LockScreenContentServer.exe. Its execution is suspicious when the file is located outside its normally expected path, but Microsoft did not specify the legitimate location to use as a reference. The process name alone is therefore insufficient to confirm an infection.

Reconnaissance Prepares the Pivot into Internal Systems

Before using the tunnel, TerminalFix gathers information about the machine and its network environment. The code searches for potentially strategic systems, including:

• domain controllers;
• databases;
• backup servers;
• gateways;
• email systems;
• Active Directory objects and configurations.

This reconnaissance helps build an initial map of the organization. The infected endpoint may be able to see services that are not directly exposed to the Internet, making it a far more useful observation and access point than an ordinary isolated workstation.

The tunneling module, developed in Python, connects to:

gitnow[.]dev:443

The communication uses an encrypted WebSocket. Within the channel, the malware can forward TCP traffic to IP addresses, hostnames, and ports reachable from the compromised computer, operating in a manner similar to a SOCKS5 proxy.

The operators can therefore instruct the host to connect to a domain controller, backup server, or any other internal service identified during reconnaissance. The victim’s system becomes a network pivot.

The module supports multiplexing, allowing multiple connections to travel over the same WebSocket. It also includes keepalive messages, remote tunnel shutdown, and User-Agent rotation to imitate different browsers. These features make the channel more stable and may cause it to blend in with normal encrypted web traffic.

The Risk Extends Across the Network, Not Just to the Infected PC

The initial interaction limits the attack to people who follow the fake CAPTCHA’s instructions. After execution, however, the potential impact extends beyond the individual user account.

If reusable credentials, administrative sessions, or access to corporate resources are present on the machine, the operator may attempt lateral movement. The tunnel also provides access to services that perimeter controls would normally protect from external connections.

Potential consequences include privilege escalation, credential theft, disabling security tools, and data exfiltration. The same access could be used to deploy ransomware, although Microsoft did not report observing this stage in the analyzed campaign.

The operator’s identity has not been determined. Based on the available evidence, TerminalFix cannot be attributed to any specific criminal or state-sponsored group.

Nor is this an issue listed in CISA’s Known Exploited Vulnerabilities catalog. TerminalFix is a social engineering technique combined with a malware delivery chain, not a vulnerability requiring a vendor patch.

Immediate Checks to Detect a Compromise

Organizations should start by reviewing PowerShell usage. They should log executed commands and look for processes launched immediately after visits to web pages, especially when those processes involve downloading ZIP archives, PNG images, or obfuscated scripts.

The main indicators and behaviors to investigate include:

• encrypted WebSocket connections to gitnow[.]dev:443;
• anomalous executions of LockScreenContentServer.exe;
• ZIP archives containing a signed executable alongside unexpected DLLs;
• closely timed downloads of three PNG files followed by the creation of executables or libraries;
• new scheduled tasks configured to run hourly;
• additions to or modifications of Registry Run keys;
• Active Directory enumeration and scans targeting critical systems;
• WebSocket traffic with numerous multiplexed TCP connections or changing User-Agent strings.

The specified domain should also be searched in historical DNS, proxy, firewall, and endpoint logs. Blocking the destination may disrupt the known channel, but it does not remove persistence or rule out the use of alternative infrastructure.

When a compromise is confirmed, the host should be isolated and its access to the internal network reviewed. Credentials available on the machine should also be rotated, including administrative or domain credentials if they were exposed, stored, or usable from the endpoint.

Prevention should include targeted awareness training: a legitimate CAPTCHA will never ask users to open Windows Terminal and paste a PowerShell command. With TerminalFix, recognizing this anomaly can stop the attack before the first download.