As cited
Copy frozen at (site build).
threat intel
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Microsoft Threat Intelligence identified the TerminalFix campaign, a variant of ClickFix that uses compromised websites to display fake Cloudflare CAPTCHA overlays and tricks users into executing malicious PowerShell commands in Windows Terminal or PowerShell. The campaign delivers a multistage attack chain featuring DLL sideloading, steganographic payload extraction via PNG files, Active Directory reconnaissance, and a custom Python-based reverse tunnel implant that grants attackers persistent network-level proxy access. The reverse tunnel capability enables attackers to pivot through the compromised host and reach additional internal systems, with potential for lateral movement, privilege escalation, and ransomware deployment once hands-on-keyboard access is established.
Why it matters: Organizations across multiple industries are targeted by TerminalFix. Practitioners must assume affected Windows hosts provide attackers with direct internal network access and should rotate credentials, investigate for lateral movement, and restrict PowerShell execution and DLL sideloading to prevent compromise and post-breach pivot activity.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Microsoft Threat Intelligence identified the TerminalFix campaign, a variant of ClickFix that uses compromised websites to display fake Cloudflare CAPTCHA overlays and tricks users into executing malicious PowerShell commands in Windows Terminal or PowerShell. The campaign delivers a multistage attack chain featuring DLL sideloading, steganographic payload extraction via PNG files, Active Directory reconnaissance, and a custom Python-based reverse tunnel implant that grants attackers persistent network-level proxy access. The reverse tunnel capability enables attackers to pivot through the compromised host and reach additional internal systems, with potential for lateral movement, privilege escalation, and ransomware deployment once hands-on-keyboard access is established.
Why it matters: Organizations across multiple industries are targeted by TerminalFix. Practitioners must assume affected Windows hosts provide attackers with direct internal network access and should rotate credentials, investigate for lateral movement, and restrict PowerShell execution and DLL sideloading to prevent compromise and post-breach pivot activity.
- Source published
- First seen by Cybersecurity Tracker