THE Microsoft Threat Intelligence team has identified a campaign named TerminalFix, a variant of ClickFix, targeting various organizations through social engineering tactics. By using compromised websites that mimic Cloudflare CAPTCHA overlays, attackers persuade users to execute a malicious PowerShell command. This command launches a multi-stage attack, incorporating techniques such as DLL sideloading, steganographic payload extraction, and extensive Active Directory reconnaissance. A notable element of this campaign is a custom reverse-tunnel implant that gives attackers persistent access to the victim's network.
The attack chain includes several phases starting from initial access via a fake CAPTCHA, execution of PowerShell commands, and payload delivery through DLL sideloading. The malware also establishes persistence through Registry Run keys and scheduled tasks. Following persistence, it conducts a thorough reconnaissance of the system, enabling attackers to gather information like domain credentials and network structures.
To combat this threat, Microsoft recommends various mitigation strategies, including restricting PowerShell execution, educating users about potential threats, and investigating affected devices to prevent lateral movements within networks.