TerminalFix: Fake CAPTCHA to PNG Steganography and WebSocket Reverse Tunnels

1. Basic Information Article Title : Microsoft warns of TerminalFix attacks deploying reverse tunnels Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Source : Microsoft Security Research Related Malware / Threat Groups / CVEs / Products : TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active Directory Severity : High 2. Executive Summary TerminalFix uses a fake Cloudflare CAPTCHA on compromised websites to trick users into pasting PowerShell commands. It then performs DLL side-loading, extracts payloads from PNG images, establishes dual persistence, and enumerates Active Directory to set up a reverse WebSocket tunnel that reaches the internal network. 3. Attack Flow From Fake CAPTCHA to Network Pivot Point A compromised website displays a fake Cloudflare Turnstile page and copies malicious PowerShell code to the clipboard. The user pastes the code into the terminal, extracting a ZIP file to C:\ProgramData and executing 1.bat . The legitimate LockScreenContentServer.exe side-loads a malicious dui70.dll . PowerShell restores the executable and DLL fragments from three PNG images. The infection creates a Run key and a 60-minute scheduled task, then hides the folder. It enumerates Active Directory and internal servers, setting up a file-monitoring command execution loop. It deploys the Python runtime and client.py to relay arbitrary TCP traffic from the external C2 to internal targets over a TLS WebSocket. 4. Attacker Position and Execution Location External attackers direct victims to view compromised websites. After execution, the compromised endpoint is operated as a pivot point between the external C2 and the internal network. 5. Visibility for Victims and Administrators Victims Tricked into opening the terminal from a realistic Cloudflare verification screen and pasting multi-line verification commands. Administrators Observable indicators include random-name fo