1.
Basic Information Article Title: Microsoft warns of TerminalFix attacks deploying reverse tunnels Publisher: BleepingComputer Publication Date: 2026-08-31 Original Source: BleepingComputer Related Source: Microsoft Security Research Related Malware / Threat Groups / CVEs / Products: TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active Directory Severity: High
2.
Executive Summary TerminalFix uses a fake Cloudflare CAPTCHA on compromised websites to trick users into pasting PowerShell commands.
It then performs DLL side-loading, extracts payloads from PNG images, establishes dual persistence, and enumerates Active Directory to set up a reverse WebSocket tunnel that reaches the internal network.
3.
Attack Flow From Fake CAPTCHA to Network Pivot Point A compromised website displays a fake Cloudflare Turnstile page and copies malicious PowerShell code to the clipboard.
The user pastes the code into the terminal, extracting a ZIP file to and executing .
The legitimate side-loads a malicious .
PowerShell restores the executable and DLL fragments from three PNG images.
The infection creates a Run key and a 60-minute scheduled task, then hides the folder.
It enumerates Active Directory and internal servers, setting up a file-monitoring command execution loop.
It deploys the Python runtime and to relay arbitrary TCP traffic from the external C2 to internal targets over a TLS WebSocket.
4.
Attacker Position and Execution Location External attackers direct victims to view compromised websites.
After execution, the compromised endpoint is operated as a pivot point between the external C2 and the internal network.
5.
Visibility for Victims and Administrators Victims Tricked into opening the terminal from a realistic Cloudflare verification screen and pasting multi-line verification commands.
Administrators Observable indicators include random-name folders in , running from a non-standard path, , PNG POST requests, Run keys, scheduled tasks, and .
6.
Conditions for Success and Failure Conditions for Success The user executes PowerShell following the fake CAPTCHA instructions.
The endpoint successfully downloads the ZIP, PNGs, and Python, and application control does not block side-loading.
WebSocket connections to are allowed.
Failure Conditions / Risk Mitigation The user refuses the CAPTCHA that asks to paste commands into the terminal.
PowerShell is restricted with Script Block Logging and Constrained Language Mode enabled.
Execution of from non-standard paths, unknown DLLs, and running is blocked.
Known C2 infrastructure and suspicious WebSockets are blocked.
7.
What Happens Upon Success Persistent code execution on the endpoint.
Enumeration of Active Directory and critical servers.
Arbitrary TCP tunneling through the infected endpoint to reach the internal network.
A foothold established for subsequent credential theft, lateral movement, and data exfiltration (though subsequent success was not observed in the report).
8.
Observable Logs Email: The primary entry point is compromised websites; public information does not specify if email was used.
Proxy/SWG/DNS: Traffic fetching ZIP files and PNG POST requests, along with connections to , , and .
Endpoint/EDR: -> -> -> , in the same folder, Run keys, scheduled tasks, , and .
Identity/IdP: Suspicious authentication occurring after domain trust, Domain Admins, and user description enumeration.
SaaS/Cloud: Check for new connections from the affected endpoint to cloud management consoles or SaaS applications.
Network: TLS WebSockets to , showing pivot behavior where multiple internal destinations are contacted over a single connection.
9.
Attack Success Assessment Attack Attempt Observed (Success Unconfirmed): Only the fake Cloudflare CAPTCHA display or malicious PowerShell clipboard copy was identified; execution was not confirmed.
User Action Confirmed: The user pasted and executed the command in Windows Terminal or PowerShell.
Initial