TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Microsoft details new TerminalFix campaign targeting organizations with fake Cloudflare CAPTCHAs to deploy malicious PowerShell commands.
Intelligence analysis by Qwen 2.5 (3B)
Microsoft warns of a new TerminalFix campaign that uses fake Cloudflare CAPTCHAs to trick users into running malicious PowerShell commands, leading to a sophisticated multi-stage attack.
A bad guy tricks you into clicking a fake CAPTCHA on a website. Instead of a regular box, it looks like a Windows Terminal window. You copy and paste a bad code into the window, and a sneaky program gets into your computer. This program spies on your network and can do bad things.
Analysis
Compromise Chain
The attack chain involves compromised websites serving fake Cloudflare CAPTCHA verifications, tricking users into executing a malicious PowerShell command.
PowerShell Command
The PowerShell command downloads a ZIP archive containing a legitimate binary and a rogue DLL, initiating a DLL sideloading attack.
Reconnaissance and Persistence
The sideloaded DLL performs reconnaissance, establishes persistence, and deploys a Python-based reverse-tunnel command-and-control (C2) implant.
Key points
- TerminalFix uses fake Cloudflare CAPTCHAs to trick users into running malicious PowerShell commands.
- The attack involves DLL sideloading, steganographic payload extraction, and extensive Active Directory reconnaissance.
- The backdoor can tunnel arbitrary TCP traffic back to attacker-controlled infrastructure.
With better security training, users can spot fake CAPTCHAs and avoid falling for the trick.
If the bad guy gets into your computer, they can see everything you do on the internet and even control your network.
