TerminalFix Explained: How Fake CAPTCHAs Turn Windows PCs Into Reverse-Tunnel Proxies

TerminalFix is a social-engineering campaign documented by Microsoft on August 28, 2026. It is a variant of the ClickFix technique: instead of exploiting a browser vulnerability, attackers persuade a person to execute code manually. The campaign begins on a compromised legitimate website but can end with a persistent reverse tunnel that gives an attacker a route through the infected Windows device into reachable internal services. 1

How the fake CAPTCHA attack works

The victim visits a legitimate website that has been modified by attackers. A fake Cloudflare Turnstile-style overlay then presents a familiar-looking “verify you are human” interaction. The crucial difference is what happens next: the page tells the visitor to copy content and paste it into Windows Terminal or PowerShell.

That instruction is the warning sign. CAPTCHA and Turnstile challenges are browser interactions; they do not require a user to open a command shell or execute clipboard content. TerminalFix relies on the user treating the command as part of the verification process rather than recognizing it as code. 1

Directing victims to Windows Terminal or PowerShell also lets the attackers deliver more complex, multi-line commands than a traditional Run-dialog lure. 1

The multistage payload chain

Once the command runs, the campaign proceeds through several layers designed to blend malicious activity with trusted tools and ordinary-looking files:

1. Archive delivery: PowerShell downloads and expands a ZIP archive into a concealed-looking directory under C:\ProgramData.
2. DLL sideloading: The archive places a Microsoft-signed LockScreenContentServer.exe beside attacker-controlled dui70.dll files. When the executable searches its local directory for a required library, it loads the malicious DLL instead. This abuses the trust associated with the signed executable without making the DLL legitimate.
3. Steganographic payloads: Later components are hidden inside PNG image data, making the payload less obvious during basic file and download inspection.
4. Persistence: Registry Run entries and scheduled tasks allow components to relaunch after logon or at scheduled intervals. 1

This structure matters for defenders because blocking one filename is unlikely to be enough. The campaign uses a sequence of behaviors—PowerShell execution, archive extraction, unusual file placement, DLL loading, image access, and persistence—that should be correlated across endpoint telemetry.

What the malware looks for

Microsoft’s analysis describes host and network discovery across system, user, process, service, network, and security context. The malware also performs Active Directory reconnaissance, helping identify the domain environment and systems or accounts that may be valuable for follow-on access. 1

For security teams, suspicious directory-service queries from an ordinary workstation deserve attention when they occur alongside the TerminalFix execution chain. Relevant activity can include enumeration of domain controllers, users, groups, trusts, shares, remote systems, or privileged accounts.

How the reverse tunnel changes the risk

The campaign’s most consequential component is a Python client.py implant launched with pythonw.exe. Because pythonw.exe does not present a normal console window, the process may be less visible to a user than a conventional command-line program. 1

The client communicates outbound over TLS and WebSockets with gitnow[.]dev. It can receive instructions to connect from the victim machine to an internal address and port, then relay the resulting TCP traffic through the encrypted WebSocket connection in a SOCKS5-like model. 1

In practical terms, the infected computer can become an externally controlled network proxy. The tunnel does not automatically grant access to every internal system: reachability and permissions still matter. But it can expose services that are not directly reachable from the public internet, making the compromise an internal-network access problem rather than only a malware-on-one-PC incident.

Detection and hunting priorities

Look for combinations of the following signals rather than treating any single artifact as conclusive:

• A browser session followed immediately by Windows Terminal or PowerShell execution, particularly after a CAPTCHA or “verification” prompt.
• PowerShell that downloads, decodes, extracts, or executes clipboard-supplied content.
• Hidden-window PowerShell or writes of archives and executables beneath unusual ProgramData locations.
• LockScreenContentServer.exe running outside its expected Windows directory, especially beside dui70.dll in an unusual or user-writable location.
• PNG files accessed shortly before new DLLs, Python files, scheduled tasks, or Run-key entries appear.
• New or modified HKCU or HKLM ...\CurrentVersion\Run values.
• Scheduled tasks with unusual names, recurring execution, suspicious paths, PowerShell, pythonw.exe, or client.py in their actions.
• pythonw.exe launched with a client.py argument and outbound TLS or WebSocket traffic to gitnow[.]dev.
• Active Directory and network discovery from a workstation that does not normally perform such enumeration. 1

Search DNS, proxy, firewall, EDR, TLS/SNI, and WebSocket telemetry for gitnow[.]dev. Microsoft’s advisory should be used for the campaign’s complete hashes, URLs, file paths, task names, and detection guidance, since filenames and infrastructure can change. 1

What to do after suspected execution

1. Isolate the endpoint. Disconnect the suspected device from the network while preserving memory, process trees, PowerShell logs, scheduled-task definitions, persistence keys, DNS and proxy records, and EDR telemetry.
2. Block and scope. Block identified domains and delivery infrastructure across DNS, secure web gateways, proxies, firewalls, and endpoint controls. Hunt across the environment for the same execution sequence before reconnecting systems.
3. Protect identities. Treat credentials used or stored on the host as potentially exposed. After containment and initial scoping, reset relevant passwords and revoke active sessions and tokens, prioritizing privileged, domain, cloud, VPN, browser, service, and API credentials accessible from the device.
4. Investigate internal activity. Review Active Directory authentication, remote-access, file-server, VPN, and administrative-tool activity associated with the endpoint and its user.
5. Rebuild when appropriate. Reimage confirmed-compromised systems where possible. Removing one DLL, scheduled task, or Run key may not remove additional persistence or access established through the tunnel.

Controls that reduce the chance of compromise

Organizations should restrict PowerShell and Windows Terminal according to role, use application control such as WDAC or AppLocker where appropriate, and avoid relying on execution policy alone as a security boundary. Least privilege and the removal of unnecessary local administrator rights reduce the impact of a successful lure.

Centralized PowerShell Script Block Logging—including Event ID 4104—along with module logging, transcription where appropriate, AMSI, endpoint detection, tamper protection, and process-creation logging can help reconstruct the execution chain. Browser and web controls should also watch for compromised-site redirects, malicious script injection, suspicious clipboard manipulation, and known command-and-control infrastructure. 1

User training should focus on a simple, memorable rule: never paste commands into Run, Command Prompt, PowerShell, or Windows Terminal because a website, CAPTCHA, browser error, advertisement, or support page tells you to. Close the page and report the URL instead.

TerminalFix demonstrates why trusted components can still participate in a malicious chain. A signed executable, Python, TLS, WebSockets, image files, and a legitimate website may each look ordinary in isolation. Effective defense therefore depends on correlating behavior, isolating endpoints quickly, and protecting identities—not just blocking a single filename or signature. 1