Reported by 5 outlets
Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Microsoft Threat Intelligence documented a ClickFix variant it calls TerminalFix that targets organizations across multiple industries. Compromised websites display a fake Cloudflare Turnstile "Verify you are human" overlay; clicking it copies a PowerShell command to the clipboard and the victim is told to paste it into Windows Terminal or PowerShell. The shift from the Run dialog to a terminal is deliberate: complex multi-line scripts execute more reliably there, and the command shows Cloudflare-themed output, including a fake confirmation that the user is not a robot.
The payload is heavier than a typical ClickFix infostealer. The pasted command downloads a ZIP that extracts into a hidden C:\ProgramData directory and launches a batch file. The archive carries the signed Windows binary LockScreenContentServer.exe next to a malicious dui70.dll, which the trusted executable sideloads. That DLL decodes an obfuscated resource in memory, pulls PNG images from attacker infrastructure, and extracts hidden payloads from pixel data using steganography. Persistence comes through both Registry Run keys and scheduled tasks.
The end state is what makes this campaign notable. Rather than stopping at credential theft, the operators run extensive Active Directory reconnaissance and deploy a custom reverse-tunnel implant that turns the compromised endpoint into a network-level proxy for reaching internal resources. Sophos followed up on September 30 with research on the campaign's evolution, describing multi-phase operations that combine DLL sideloading with Python-based tunneling implants and covert tunneling through the Lorem Ipsum loader, so the tooling is being actively reworked rather than reused static.
Watch for two things. First, fake CAPTCHA verification pages remain the entry point, so users pasting commands into terminals from web pages should be treated as a compromise indicator worth alerting on. Second, the reverse-tunnel stage means a single infected host can expose the internal network, so egress filtering and detection of unexpected tunnel processes matter as much as blocking the initial PowerShell. Microsoft's write-up includes mitigation guidance for the full chain.
Timeline
-
original reporting
Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel
gbhackers.com · 45d ago · August 29th, 2026
A newly documented TerminalFix campaign is using fake Cloudflare CAPTCHA prompts to trick users into manually executing malicious PowerShell commands, ultimately turning compromised Windows devices into reverse-tunnel pivot points for attackers. Microsoft said the activity targets organizations through compromised websites that replace legitimate content with a convincing Cloudflare Turnstile-style “Verify you are human” overlay. Rather […] The post Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from microsoft.com
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
microsoft.com · 46d ago · August 29th, 2026
In this article Attack chain overview Mitigation and protection guidance Learn more Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully. Unlike earlier ClickFix variants that typically deliver a single infostealer, this TerminalFix campaign deploys a sophisticated multi-stage attack chain that combines DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant – giving the attacker persistent, network-level proxy access through the compromised host. Once executed, the PowerShell command masquerades as a Cloudflare verification process while downloading a ZIP archive containing a legitimate binary ( LockScreenContentServer.exe ) and a malicious DLL ( dui70.dll ) used for sideloading. The sideloaded DLL drives an elaborate second stage: downloading payloads concealed inside PNG images using steganography, establishing dual persistence through Registry Run keys and scheduled tasks, conduc
-
mentioned by malware.news
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
malware.news · 46d ago · August 29th, 2026
-
update from cyberpress.org
Microsoft Warns TerminalFix ClickFix Campaign Uses Fake CAPTCHA to Deploy Reverse Tunnel
cyberpress.org · 45d ago · August 29th, 2026
After a victim clicks the “Verify you are human” prompt, the site copies a malicious command to the clipboard and instructs the user to open Windows Terminal or PowerShell and paste it. Microsoft Warns TerminalFix ClickFix Campaign Microsoft calls the technique TerminalFix because it shifts the familiar ClickFix social-engineering pattern from the Windows Run dialog to Terminal or PowerShell. TerminalFix attack chain (Source: Microsoft) The observed command downloads a ZIP archive, extracts it under a hidden ProgramData directory, and launches a batch file in the background. Because the executable loads the DLL from its application directory, the attackers use DLL sideloading to run their code inside a trusted process. The DLL then decodes an obfuscated resource in memory and launches a second-stage PowerShell-based payload. That stage retrieves PNG files from attacker-controlled infrastructure and extracts embedded payload data
-
update from gbhackers.com
TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach Networks
gbhackers.com · 43d ago · August 31st, 2026
Rather than delivering a conventional infostealer, the campaign builds persistent access and deploys a reverse-tunnel implant capable of turning an infected Windows endpoint into a proxy for reaching internal network resources.
-
update from cyberpress.org
TerminalFix Attack Uses Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks
cyberpress.org · 43d ago · August 31st, 2026
The page shows a “Verify you are human” prompt, Cloudflare branding, and a loading animation. When users click the verification box, a malicious PowerShell command is copied to their clipboard. The command appears legitimate because it displays Cloudflare-themed messages, including a false confirmation that the user is not a robot. The sideloaded DLL starts the next stage of the infection. Fake Cloudflare Turnstile verification displayed on a compromised website (Source: microsoft) This steganography technique helps disguise the payloads as harmless image files and makes network inspection more difficult. The extracted components include additional executables, DLL
-
update from www.sophos.com
(sophos.com) Evolution of TerminalFix: A Multi-Phase Malware Campaign Leveraging DLL Sideloading and Python-Based Tunneling Implants In brie
www.sophos.com · 13d ago · September 30th, 2026
(sophos.com) Evolution of TerminalFix: A Multi-Phase Malware Campaign Leveraging DLL Sideloading and Python-Based Tunneling Implants In brie
via Mastodon https://www.sophos.com/en-us/blog/terminalfix-and-lorem-ipsum-loader-enable-covert-tunneling