A new ClickFix offshoot is swapping the Windows Run dialog for Terminal or PowerShell windows. Microsoft Threat Intelligence is tracking the campaign, dubbed TerminalFix, which drops fake Cloudflare CAPTCHA overlays on compromised sites to make victims run malicious PowerShell commands, a shift that improves the odds of complex multi-line scripts executing cleanly.
The campaign deploys a sophisticated multi-stage chain rather than a single infostealer. The PowerShell payload poses as a Cloudflare check while pulling down a ZIP archive that pairs the legitimate LockScreenContentServer.exe with a malicious dui70.dll meant for sideloading. That DLL drives the next stage: payloads concealed inside PNG images via steganography, dual persistence through Registry Run keys and scheduled tasks firing every 60 minutes, and directory hiding with system and hidden attributes.
The malware then performs extensive reconnaissance, including domain trust discovery, domain admin enumeration, Active Directory user description harvesting and targeted server ping sweeps. A persistent file-watch loop also executes PowerShell from a watched text file, forming an asynchronous command channel. Finally, it deploys a custom Python-based reverse-tunnel implant, using an unmodified signed embeddable Python runtime from python.org, that tunnels arbitrary TCP traffic back through an encrypted WebSocket connection to attacker infrastructure.
Microsoft says the scripts include English, Spanish and German locale variants, and the tunnel gives attackers network-level proxy access that turns compromised hosts into pivot points. The guidance: treat affected devices as potential lateral-movement entry points, review ClickFix detections, and block unsigned PowerShell launched from browsers.
