TerminalFix: The Fake CAPTCHA That Opens a Back Door Into Company Networks

Key points

• Microsoft has documented a new attack called TerminalFix that uses fake Cloudflare CAPTCHA prompts on hacked websites to trick people into running attacker commands.
• The attack routes victims to Windows Terminal or PowerShell, letting the criminals run longer, more complex scripts than usual.
• The final payload is a custom Python tool that opens a reverse tunnel to gitnow[.]dev on port 443, giving attackers a route into the victim's internal network.
• Payload files are hidden inside three PNG images using steganography, the practice of concealing data inside ordinary-looking pictures.
• Microsoft has not seen hands-on-keyboard activity yet but warns the access could be used for ransomware, credential theft, or data theft.

Microsoft researchers have flagged a new scam that dresses up a hostile command as a routine "prove you're human" check. They call it TerminalFix, and it is a nastier cousin of the ClickFix attacks that have plagued the web for the past year.

The trick starts on a hacked website. Visitors see what looks like a Cloudflare CAPTCHA, the familiar checkbox that sites use to weed out bots. The page tells them to open Windows Terminal, which is the black command window built into Windows, and paste a line that has quietly been copied to their clipboard.

That single paste is the whole attack.

What does the attack actually do?

It downloads a ZIP file, quietly installs a hidden tool, and hands the attackers a way back into the machine. From there they can reach other computers on the same office network.

The pasted command pulls down an archive containing a real, signed program alongside a malicious DLL, a helper file that Windows programs load at startup. The signed program is bait: Windows trusts it, so it runs. The DLL rides along, decodes an obfuscated payload, and launches it directly in memory so nothing suspicious ever hits the disk in plain form.

The second stage is more inventive. The script fetches three PNG images from an attacker server and rebuilds an executable and DLL fragments out of the pixels. This is steganography: real image files that also contain smuggled code. To a network monitor, it just looks like someone loading pictures.

The malware sticks around by adding a scheduled task and a Windows Registry Run key, both set to fire every hour.

Why is the reverse tunnel the dangerous part?

Because it turns the infected PC into a doorway. Once the tunnel is live, the attacker can reach anything that PC can reach: file servers, databases, backup systems, mail servers.

The tunnel is a custom Python module that dials out to gitnow[.]dev on port 443 over an encrypted WebSocket, the same kind of connection your browser uses for chat apps. It supports SOCKS5-style proxying, which in plain terms means the attacker can pipe traffic through the victim's machine to any internal address they choose. It juggles multiple connections at once, rotates fake browser identifiers to blend in, and can be shut down remotely to cover tracks.

Before the tunnel goes up, the malware scouts the neighbourhood. It probes for domain controllers (the servers that hold company logins), databases, backups, gateways and mail systems, and enumerates Active Directory, Microsoft's directory of user accounts and permissions.

Who is at risk and what happens next?

Anyone who lands on a hacked page and follows the fake CAPTCHA instructions. Microsoft, which first reported the campaign alongside BleepingComputer's coverage, says it has not yet seen operators typing commands live on infected machines. That does not mean they will not.

The likely next steps, based on what the tooling supports, are lateral movement to other machines, privilege escalation, credential theft, disabling security software, data theft, or ransomware.

What should defenders and users do?

For IT teams, Microsoft recommends restricting who can run PowerShell, logging every PowerShell command, watching for LockScreenContentServer.exe running from unusual folders, and tightening browser and endpoint settings. If a machine is confirmed infected, hunt for signs the attackers moved sideways and rotate every credential the box could see, especially domain admin accounts.

For ordinary users the rule is blunt: no legitimate website will ever ask you to open Windows Terminal, PowerShell, or the Run box and paste something in to prove you are human. If a CAPTCHA tells you to do that, close the tab.