Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers

Attackers are using fake CAPTCHA prompts to trick victims into running malicious PowerShell commands as part of a multi-stage intrusion campaign that can establish persistence, conduct network reconnaissance and potentially give operators a path to deeper access within an organization. Microsoft Threat Intelligence said a campaign it calls TerminalFix, a variant of the ClickFix technique, uses compromised websites to display a fake Cloudflare verification prompt. Victims are tricked into copying and running a malicious PowerShell command, starting an attack chain involving DLL sideloading, payloads hidden inside PNG images, persistence, Active Directory reconnaissance and, eventually, a custom reverse-tunnel implant. “While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully,” the company said in a blog post. The company has provided detection coverage, IOCs, hunting queries, and mitigation and response guidance for the observed activities. ‘Prove you’re human’ gets decidedly inhuman The initial lure is a fake Cloudflare CAPTCHA verification overlay displayed on compromised websites. But instead of simply asking a visitor to click a checkbox, the prompt instructs to copy and execute a PowerShell command. The command downloads a ZIP archive containing a legitimate Windows binary, “LockScreenContentServer.exe,” alongside a malicious DLL called “dui70.dll.” These two are then used for DLL sideloading, a technique in which a legitimate executable loads a malicious library. The sideloaded DLL downloads additional payloads concealed inside PNG images using stenography, Microsoft said. It also establishes persistence through both Registry Run and scheduled tasks, ensuring the malware has more than one way to survive on the compromised system. The attack then moves to reconnaissance. Microsoft observed the malware enumerating domain trusts, looking for domain administrators, extracting Active Directory user descriptions and conducting targeted ping sweeps to identify reachable systems. The final act is a tunnel into the network The campaign’s final payload is a custom, Python-based reverse-tunnel implant. After downloading a Python runtime and a tunneling client, the malware uses pythonw.exe to launch the implant without a visible window, Microsoft explained. The implant then establishes an encrypted WebSocket connection to attacker-controlled infrastructure, creating what Microsoft describes as full SOCKS-style TCP proxy access through the compromised host. Rather than merely maintaining control of a single endpoint, the attacker can potentially use the infected device as a bridge into the internal network. Microsoft said the reconnaissance activity and reverse-tunnel capability could allow an operator to identify and reach additional systems from the compromised host. Microsoft stressed that it did not observe the downstream actions that could follow in the analyzed campaign. But the access obtained could provide the foundation for lateral movement, privilege escalation, data theft or other follow-on-activity. Microsoft recommended thoroughly investigating affected hosts and hunting for unusual execution of LockScreenContentServer.exe from non-standard paths, suspicious PowerShell activity, hidden payload directories, and unusual outbound connections associated with the campaign.