Attack hides malware in PNGs and drops custom reverse tunnel on victims’ machines
Microsoft has identified a new attack campaign dubbed "TerminalFix" that tricks victims into running malicious PowerShell commands via a fake Cloudflare CAPTCHA prompt, ultimately installing a custom reverse tunnel that gives attackers persistent, network-level access to compromised machines. It is a more sophisticated variant of the widespread "ClickFix" social engineering technique, directing users to Windows Terminal or PowerShell rather than the Run dialog, which increases the chance that multi-line malicious scripts get executed unknowingly. Microsoft declined to say how many organisations have been affected or who is behind the campaign.
The attack chain begins with a spoofed Cloudflare verification checkbox that copies a malicious command to the clipboard for the victim to paste and run, downloading a ZIP file that launches a signed Windows executable used for DLL sideloading. A malicious DLL then fetches further payloads hidden inside PNG images using steganography, split across three files to evade detection, before deleting the source images to cover its tracks. The malware secures persistence via registry keys and hourly scheduled tasks, conducts Active Directory and domain reconnaissance across multiple languages, and probes named servers such as domain controllers, databases and mail systems to identify further targets, while a PowerShell loop awaits further commands from the attacker.
- New "TerminalFix" attack tricks users into running malicious PowerShell scripts
- Malware hides payloads inside PNG images using steganography
- Installs reverse tunnel and probes networks for further attack targets
New here? Start with this
Cloudflare provides services that help websites manage traffic and check that visitors are human. Attackers can copy its verification screens to make a web page look trustworthy, then persuade visitors to run commands on their own Windows computers. This kind of deception is known as social engineering.
PowerShell and Windows Terminal are tools for running commands on Windows. Attackers may abuse them to download and install software, while hiding parts of that software inside ordinary-looking image files. A reverse tunnel can let an attacker send instructions to a compromised computer over a network connection.
Once malicious software is installed, it may try to remain on the computer and look for other systems on the same organisation’s network, such as servers holding email or databases. This can put more than one computer at risk, although the extent of any particular campaign depends on how many systems are affected and what access the attackers gain.