SNACK: Three Things to Know
- TerminalFix uses a fake Cloudflare CAPTCHA or Turnstile-style page to tell users to run commands in Windows Terminal or PowerShell.
- The command can lead to DLL sideloading, hidden payload extraction, Active Directory reconnaissance, and a reverse tunnel through the victim network.
- A real CAPTCHA should never ask you to paste a command into a terminal. Close the page, do not run it, and report it to the appropriate security owner.
TerminalFix Hides Behind a Familiar Verification Screen
Microsoft Threat Intelligence observed TerminalFix, a ClickFix variant targeting organizations across multiple industries. Compromised websites display an overlay designed to resemble a Cloudflare CAPTCHA or Turnstile check.
Instead of completing a normal challenge in the browser, visitors are instructed to copy a command and execute it in Windows Terminal or PowerShell. The command is presented as if it were part of Cloudflare verification.
How It Differs from a Normal CAPTCHA
A normal CAPTCHA keeps the interaction inside the webpage, such as selecting a checkbox or completing a displayed challenge. TerminalFix moves the user into the operating system and asks them to execute copied text as a command.
That request is the warning sign. A page does not need access to Terminal or PowerShell to confirm that a visitor is human, even when its design closely imitates a familiar Cloudflare prompt.
What Happens After the Command Runs
According to Microsoft, the disguised command downloads a ZIP archive containing the legitimate LockScreenContentServer.exe and a malicious dui70.dll. The pair is used for DLL sideloading.
Microsoft also describes steganographic payload extraction and Active Directory reconnaissance in the intrusion chain. A custom implant then runs through pythonw.exe, allowing it to operate without displaying a visible window.
The Next Stage Opens a Reverse Tunnel
The implant connects to gitnow[.]dev:443 and opens a reverse WebSocket tunnel. Microsoft says this provides SOCKS-style TCP proxy access through the victim network.
The reported activity therefore continues well beyond the fake verification screen. One copied command leads into a multistage chain involving a download, DLL sideloading, network reconnaissance, and reverse-tunnel access.
Why This Is Worth Sharing
The lure copies a verification interface that many people already recognize. For family members and small teams, a simple training rule is useful: a CAPTCHA should never require anyone to open a terminal and paste a command.
If a website gives those instructions, close it and do not execute the copied text. On a managed or workplace device, report the page to the person responsible for the device or the organization’s security team.
Sources and checked date: Checked on August 29, 2026 UTC against the official Microsoft Security Blog article and images.
Leave a comment