The CAPTCHA was the Door. TerminalFix Turned One Windows PC Into a Network Tunnel.
Microsoft has observed a TerminalFix campaign targeting organisations across multiple industries. It starts with a familiar ClickFix lure: a compromised website displays a fake human-verification prompt and tells the visitor to paste a command into Windows Terminal or PowerShell.
What follows is more consequential than the usual one-stage infostealer. The command starts a chain involving DLL sideloading, payloads concealed inside PNG images, persistent Active Directory reconnaissance and a custom reverse tunnel. The compromised computer becomes a proxy through which an operator can reach systems visible from inside the victim’s network.
The important unit of risk is therefore not the first workstation. It is every internal service that workstation can reach.
The verification prompt was only the handoff
The campaign begins on a compromised website that briefly shows its normal content before replacing it with a fake Cloudflare-style verification overlay. Clicking the prompt copies a PowerShell command to the clipboard. The visitor is then instructed to open Windows Terminal or PowerShell, paste the command and execute it.
Nothing has been verified. The user has been persuaded to cross the browser-to-operating-system boundary on the attacker’s behalf.
TerminalFix differs from earlier ClickFix activity by steering victims towards Terminal or PowerShell rather than only the Windows Run dialog. That makes it easier to execute complex, multiline commands while presenting the action as part of a routine verification process.
BlackTree has previously covered attackers using trusted package mirrors to host fake verification pages. TerminalFix uses a similar social-engineering idea, but its post-click objective is different: it builds durable access to the internal network.
A signed Windows binary provides cover
The pasted command downloads a ZIP archive, extracts it beneath C:\ProgramData and launches a batch file. The archive contains a legitimate Microsoft-signed copy of LockScreenContentServer.exe beside a malicious file named dui70.dll.
When the executable starts outside its normal Windows location, it loads the attacker’s DLL from the same directory. This is DLL sideloading, not evidence that Microsoft’s code-signing infrastructure was compromised. The trusted executable is being used as the host for untrusted code.
The malicious DLL then launches an obfuscated PowerShell stage. Additional components are hidden inside the pixel data of PNG images and reconstructed on the endpoint. The combination of a signed process, in-memory decoding, steganography and hidden directories makes the chain harder to understand from any single alert.
| Stage | What the attacker gains |
|---|---|
| Fake verification prompt | User-assisted execution outside the browser |
| Signed executable and malicious DLL | Execution inside a trusted-looking process |
| Image-based payload delivery | Obfuscated staging that can evade simple file inspection |
| Registry key and scheduled task | Persistence across logons and recurring execution |
| Domain reconnaissance | A map of valuable identities and internal systems |
| Reverse WebSocket tunnel | A route from attacker infrastructure into the victim’s network |
The reverse tunnel changes the incident
The final observed stage downloads an official embeddable Python runtime and launches a custom client.py implant through pythonw.exe, so no console window is shown. The implant connects outbound over TLS on port 443, upgrades the connection to WebSocket and multiplexes traffic through a compact custom protocol.
Its address handling supports IPv4, IPv6 and hostnames. The remote operator can instruct it to connect to arbitrary internal hosts and ports that are reachable from the compromised endpoint. Certificate verification is disabled in the implant, while rotating browser-like user-agent strings help the traffic resemble an ordinary encrypted web session.
This turns the endpoint into a network pivot. An external actor no longer needs direct internet exposure on a domain controller, database or backup server if the compromised workstation can reach it for them.
Microsoft says it did not observe the downstream actions that this access could enable in the analysed chain. There is no basis to claim that the campaign has already produced ransomware deployment, data theft or successful lateral movement in every affected organisation. The capability and reconnaissance are nevertheless sufficient to justify a broader incident response.
The reconnaissance shows what matters next
Before deploying the tunnel, TerminalFix performs extensive domain discovery. Microsoft observed commands for domain-trust enumeration, domain administrator membership, computer and user discovery, user-description collection, targeted server ping sweeps and general system information.
The scripts include logic for systems configured in multiple languages. The activity is therefore not limited to one English-language environment.
The campaign also establishes redundant persistence through a Registry Run key and a scheduled task that relaunches the sideloading executable every hour. Removing the visible terminal window or closing the browser does not remove the access.
Once any TerminalFix indicator is confirmed, the affected computer should be treated as a potential bridge into the rest of the domain.
What defenders should do now
- Hunt for
LockScreenContentServer.exerunning from any location other than its legitimate Windows system path, especially beneathC:\ProgramData. - Correlate that process with a neighbouring
dui70.dll, PowerShell activity, image downloads, Registry Run keys and newly created hourly scheduled tasks. - Investigate outbound WebSocket traffic to
gitnow[.]devover port 443 and preserve surrounding DNS, proxy, endpoint and firewall telemetry. - Isolate confirmed hosts before deleting artefacts. The priority is to interrupt the tunnel while preserving evidence of internal connections and commands.
- Review credentials, sessions and tokens that were available from the affected endpoint. Prioritise privileged and domain accounts if the device was domain joined.
- Search for the reconnaissance described by Microsoft, including domain-trust queries, domain-admin enumeration, ADSI searches and targeted server discovery.
- Enable PowerShell script-block logging and centralise the logs. Consider Constrained Language Mode and application-control policies where operationally practical.
- Alert when signed Windows utilities execute from unexpected directories or load libraries from writable paths. Process reputation alone is not a sufficient trust decision.
- Restrict unnecessary east-west access from user workstations. A tunnel is less valuable when the endpoint cannot freely reach administrative, database and backup services.
- Teach users that no legitimate CAPTCHA requires them to paste commands into Terminal, PowerShell or the Run dialog. Training should be paired with technical controls that restrict or warn on the behaviour.
The security boundary was crossed by consent
TerminalFix does not need a browser zero-day. It asks the user to move attacker-controlled text from a webpage into a trusted execution environment, then uses legitimate binaries and encrypted outbound traffic to make the result look routine.
That is why the campaign is more than another fake-CAPTCHA story. The social-engineering step lasts seconds. The reverse tunnel is designed to turn those seconds into persistent network-level access.
Sources and further reading
- Microsoft Security, TerminalFix campaign deploys a reverse tunnel through multistage intrusion, published 28 August 2026. The source provides no publication time.
- CISA, FBI, HHS and MS-ISAC, #StopRansomware: Interlock, published 22 July 2025. This advisory documents the broader fake-CAPTCHA and malicious copy-and-paste pattern.
- MITRE ATT&CK, Hijack Execution Flow: DLL, T1574.001, last modified 12 May 2026.
- MITRE ATT&CK, Protocol Tunnelling, T1572, accessed 30 August 2026.
