PNG Pixels Mask Reverse Tunnel: How TerminalFix Turns Images Into Enterprise Network Backdoors

Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers

Attackers are using fake CAPTCHA prompts to trick victims into running malicious PowerShell commands as part of a multi-stage intrusion campaign that can establish persistence, conduct network reconnaissance and potentially give operators a path to deeper access within an organization. Microsoft Threat Intelligence said a campaign it calls TerminalFix, a variant of the ClickFix technique, uses compromised websites to display a fake Cloudflare ve…

PNG Pixels Mask Reverse Tunnel: How TerminalFix Turns Images Into Enterprise Network Backdoors

Microsoft has exposed TerminalFix, a ClickFix evolution that tricks users into running PowerShell which sideloads a DLL, extracts malware from steganographic PNGs, maps Active Directory, and installs a custom Python reverse WebSocket tunnel for network-wide proxy access. The multi-stage attack deletes evidence and builds redundant persistence.

TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard. Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instruc…