Microsoft’s TerminalFix Attack Uses Fake CAPTCHAs to Open a Reverse Tunnel

TerminalFix is a Microsoft-tracked ClickFix campaign that replaces a normal security check with a dangerous instruction: open Windows Terminal or PowerShell, paste a command, and run it. Microsoft described the activity on August 28, 2026, as a variant that uses compromised websites and fake Cloudflare CAPTCHA verification to execute a multistage intrusion. 3

The campaign is more serious than a one-time malware download. Its reported end state is a reverse-tunnel implant capable of providing network-level proxy access through the compromised Windows host, potentially giving an operator a route toward internal systems and services. 3 15

How the TerminalFix attack works

1. A legitimate website becomes the delivery point

The attackers compromise otherwise legitimate websites and place a fake Cloudflare Turnstile-style CAPTCHA overlay over the page. The lure is designed to look like a routine “verify you are human” check, but it instructs the visitor to copy and paste a command into Windows Terminal or PowerShell. 3 29

That change in delivery method is central to the campaign. Traditional ClickFix attacks commonly direct victims to the Windows Run dialog; TerminalFix instead uses Windows Terminal or PowerShell, making it easier for a more complex, multi-line script to run successfully. 1 3

2. PowerShell downloads the sideloading components

The pasted PowerShell chain downloads a ZIP archive containing two important files:

• A legitimately signed LockScreenContentServer.exe
• A malicious dui70.dll

When the signed executable is launched, it loads the attacker-controlled DLL through DLL sideloading. Using a signed executable helps the chain appear less suspicious than a directly launched unknown binary. The supplied reporting identifies these filenames, but does not establish exact hashes or confirm that the legitimate executable was modified. 29

3. PNG files conceal later payloads

The campaign hides later-stage components inside PNG files using steganography. Those files are then read and decoded locally, allowing the intrusion to retrieve additional code without presenting every stage as an obvious executable download. 10 29

4. Persistence and reconnaissance follow

The reported activity establishes persistence with both a Registry Run entry and a scheduled task. It also performs host and Active Directory reconnaissance before deploying the tunnel, which raises the risk beyond the initially infected endpoint. 4 29

The combination matters to defenders: a user who ran the fake CAPTCHA command may not be dealing with an isolated workstation infection. The host can become a staging point for discovery and network access.

5. A Python implant creates the reverse tunnel

The campaign deploys a Python-based reverse-tunnel component through pythonw.exe. It communicates with gitnow[.]dev over TLS and WebSockets on TCP port 443, then relays SOCKS5-style TCP traffic. In practical terms, the infected computer can act as a proxy between the operator and resources reachable from the victim network. 3 10

This is why Microsoft’s description of the implant as providing network-level proxy access is more significant than a conventional infostealer alert: the attacker’s objective can include internal network reachability, not just data collection from the first host. 3 15

Indicators to investigate

The supplied sources do not include a complete Microsoft IOC table, hashes, or every command and persistence name. Security teams should therefore treat the following as hunting leads rather than a substitute for the original Microsoft detections.

Network activity

• DNS, proxy, firewall, and TLS or WebSocket connections to gitnow[.]dev
• Unusual outbound TCP/443 activity from user workstations
• Connections that began shortly after a suspicious browser session or PowerShell execution

Processes and files

• pythonw.exe running from an unexpected directory
• pythonw.exe spawned by PowerShell, Windows Terminal, or LockScreenContentServer.exe
• LockScreenContentServer.exe located alongside dui70.dll
• ZIP archives downloaded into user-profile or temporary directories
• PNG files read or decoded by PowerShell or Python
• Python scripts, interpreters, or embedded runtimes launched from user-writable paths

Persistence

• New or unfamiliar Registry Run entries
• Scheduled tasks that launch PowerShell, Python, pythonw.exe, or files from %AppData%, %LocalAppData%, %Temp%, Downloads, or similar locations

Command-line behavior

• Interactive PowerShell or Windows Terminal activity immediately following a browser visit
• Download, decode, and execute chains
• Encoded or heavily obfuscated PowerShell
• Commands pasted into a terminal during a purported CAPTCHA or verification step

What defenders should do after a suspected exposure

Isolate first, then preserve evidence

Disconnect the suspected host from the network using the organization’s incident-response process, while preserving relevant endpoint, browser, process, and network evidence. Investigate the host, its user account, and its outbound connections rather than treating the event as an ordinary unwanted download.

Scope for internal access

Search for the indicators above across endpoints, DNS, proxy, firewall, identity, and remote-access logs. Review Active Directory and domain-controller telemetry for reconnaissance, suspicious account or group queries, and signs of lateral movement. The reverse-tunnel capability makes scoping internal reachability especially important. 4 29

Rotate potentially exposed credentials

Reset credentials and revoke active sessions or tokens for affected users. Prioritize privileged, service, and administrator accounts that were used on the compromised host, particularly if the host could reach sensitive systems.

Restrict high-risk execution paths

Limit PowerShell and Windows Terminal access to approved administrative or development populations where feasible. Apply least privilege and application control, and alert on unapproved Python interpreters or execution from user-writable directories.

Improve telemetry

Enable PowerShell Script Block Logging, module logging, and transcription where appropriate. Ensure endpoint visibility covers process creation, scheduled-task changes, Registry persistence, DNS lookups, and outbound TLS connections. These signals can help connect the original browser lure to later execution and network activity.

Block and monitor the reported infrastructure

Block gitnow[.]dev and investigate historical connections to the domain. Domain blocking should be paired with behavioral monitoring rather than used alone, since attacker-controlled infrastructure can change.

The user-facing warning is simple

A legitimate CAPTCHA may ask someone to click a checkbox or complete an in-browser interaction. It should not tell the user to open a terminal, paste an unknown command, or run PowerShell. That instruction is the decisive social-engineering red flag in TerminalFix. 1 3

For organizations, user education is most effective when it names the exact behavior to avoid: never copy and execute a command supplied by a web page merely to pass a CAPTCHA or “fix” a browser problem. If someone has already followed that instruction, the safest next step is to report the incident immediately and stop using the device until it has been assessed.