A newly documented TerminalFix campaign is using fake Cloudflare CAPTCHA prompts to trick users into manually executing malicious PowerShell commands, ultimately turning compromised Windows devices into reverse-tunnel pivot points for attackers.
Microsoft said the activity targets organizations through compromised websites that replace legitimate content with a convincing Cloudflare Turnstile-style “Verify you are human” overlay.
Rather than exploiting a browser vulnerability, the campaign relies on social engineering to persuade victims to copy and run attacker-provided commands.
Hackers Use Fake Cloudflare CAPTCHA
The technique is a variation of ClickFix, a growing social engineering method in which victims are instructed to execute commands to resolve a fake browser error, CAPTCHA, or security error.
Microsoft calls this variant TerminalFix because it moves the execution step away from the Windows Run dialog and into Windows Terminal or PowerShell.
After a victim clicks the fraudulent CAPTCHA prompt, the site copies a malicious command to the clipboard and tells the user to open Windows Terminal or PowerShell and paste it.
The command downloads a ZIP archive, extracts its contents into a concealed directory under ProgramData, and starts a batch file in the background.
The downloaded archive includes the legitimate Microsoft-signed LockScreenContentServer.exe binary and a malicious dui70.dll library.
Attackers abuse DLL sideloading by placing the rogue DLL in the executable’s application directory, causing the trusted Windows binary to load and execute the malicious code. The DLL decodes an obfuscated resource in memory before launching a second-stage PowerShell payload.
That payload retrieves apparently harmless PNG images from attacker-controlled infrastructure, then extracts hidden payload data from their pixel channels. It reconstructs a portable executable and DLL from the image files before deleting the original downloaded components.
The malware also establishes persistence through a Registry Run key and a scheduled task configured to relaunch LockScreenContentServer.exe every 60 minutes.
The attackers further conceal their staging folder by applying system and hidden attributes to the ProgramData directory. Microsoft observed the campaign gathering system information and conducting extensive Active Directory reconnaissance.
The malware enumerates users, computers, trusts, domain administrators, and potentially valuable internal services, including domain controllers, databases, backup systems, gateways, and mail servers.
Most significantly, the operation deploys an embeddable Python runtime and a custom client.py implant launched through pythonw.exe. The implant connects to gitnow[.]dev over TLS on port 443, upgrades the connection to WebSocket, and relays arbitrary TCP traffic.
Its SOCKS5-style handling enables operators to reach internal IPv4, IPv6, or hostname-based targets accessible from the infected endpoint.
Although Microsoft did not observe follow-on intrusion actions in the analyzed chain, the combination of internal reconnaissance and reverse tunneling makes infected systems potential footholds for lateral movement, credential theft, data exfiltration, or ransomware deployment.
Defenders should investigate users who interacted with suspicious CAPTCHA prompts or executed unusual PowerShell commands.
Priority indicators include LockScreenContentServer.exe running outside C:WindowsSystemApps, hidden ProgramData folders, dui70.dll beside the executable, suspicious Run keys or scheduled tasks, pythonw.exe activity, and outbound connections to suspected tunnel infrastructure.
Organizations should restrict unnecessary use of PowerShell and Windows Terminal, enable script block logging, and apply application control policies. User training should reinforce one rule: legitimate CAPTCHA pages never ask users to paste commands into a terminal.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
