Microsoft Warns of TerminalFix Campaign Using Fake Verification Prompts to Install Network Tunneling Implants

Cybersecurity researchers from Microsoft have issued a warning regarding an ongoing social engineering campaign dubbed “TerminalFix.” The operation compromises legitimate websites to display fake verification prompts, manipulating visitors into copying and executing malicious commands within Windows Terminal or PowerShell. Once executed, the commands launch a multi-stage infection process that culminates in the deployment of a persistent network-tunneling implant.

While traditional web-based attacks often seek quick gains—such as stealing saved browser passwords or session tokens—TerminalFix is engineered for deeper infrastructure access. By establishing an encrypted reverse tunnel into the victim’s internal network, the campaign allows threat actors to bypass perimeter defenses and position themselves for broader network intrusion, internal reconnaissance, and potential ransomware deployment.

From ClickFix to TerminalFix: Evolution of Social Engineering Tactics

The TerminalFix campaign represents a technical refinement of a social engineering design known as the “ClickFix” attack pattern. In standard ClickFix scenarios, compromised web pages present visitors with error messages or CAPTCHA-style verification overlays. These prompts direct users to press specific keyboard shortcuts—often opening the Windows Run dialog—and paste a command pre-copied to their clipboard.

TerminalFix alters this approach by steering target users directly into Windows Terminal or standalone PowerShell environments instead of the basic Run prompt. Microsoft researchers noted that this shift significantly improves attack reliability. Windows Terminal provides a full command-line shell environment capable of parsing and executing complex, multi-line scripts without running into character limits or formatting glitches that often interrupt execution in simpler dialog windows.

The visual lure on compromised sites frequently mimics routine security checks, such as Cloudflare CAPTCHA screens. Users are instructed to perform a series of manual steps to prove they are human. Because modern internet users regularly interact with bot-detection checks, the request to paste and run text can appear legitimate to unsuspecting individuals, turning the end user into an unwitting delivery vehicle for the attack script.

Technical Breakdown: Sideloading and Payload Execution

The execution pipeline of TerminalFix relies on living-off-the-land techniques and binary hijacking to bypass standard endpoint security software. When a victim pastes the provided command into PowerShell, the script executes a chain of distinct operational phases:

Initial Payload Retrieval: The PowerShell script connects to an external server controlled by the threat actors to retrieve two key files: a legitimate, digitally signed binary file and a companion dynamic-link library (DLL) file engineered with malicious logic.

DLL Sideloading: To evade detection by antivirus and Endpoint Detection and Response (EDR) agents, the attack utilizes DLL sideloading. When the legitimate binary runs on the target system, it automatically searches for and loads the accompanying malicious DLL from the local directory. Because the primary executable is trusted and signed, security controls may allow the execution to proceed unhindered while the malicious DLL runs silently in the background.

Implant Deployment: Once loaded, the malicious DLL drops and executes a hidden payload designated as client.py. This custom Python script serves as the core remote access implant for the campaign.

Tunnel Creation: The client.py implant initiates an encrypted WebSocket connection back to the attacker’s command-and-control (C2) infrastructure. This channel creates a SOCKS5-style proxy, effectively bridging the attacker’s external systems directly into the victim’s internal network environment.

Architectural Comparison: ClickFix vs. TerminalFix

To understand the operational shift between traditional social engineering scripts and the TerminalFix campaign, the structural differences between these two methodologies can be observed across key technical vectors:

Strategic Threat: SOCKS5 Proxies and Internal Network Pivoting

The primary danger of the TerminalFix campaign stems from the nature of the access it establishes. Rather than merely harvesting stored data from a single device, the SOCKS5 proxy configuration transforms the compromised host into an internal network pivot point.

Because the reverse tunnel is initiated as an outbound connection via standard web traffic protocols (encrypted WebSockets), it frequently bypasses strict inbound firewall rules and network address translation (NAT) barriers. For corporate security teams, traffic passing through an established outbound WebSocket connection can easily blend in with normal administrative or web browsing activity.

Once the reverse tunnel is active, remote threat actors gain virtual presence on the internal network segment to which the compromised endpoint belongs. From this vantage point, attackers can perform several critical post-exploitation activities:

• Internal Network Reconnaissance: Attackers can scan local subnets to map active IP addresses, open ports, and available network shares.
• Domain Controller Probing: Threat actors can interact directly with Active Directory infrastructure to evaluate domain relationships, audit user groups, and identify high-value targets.
• Command Execution: The implant enables remote operators to issue system commands directly to the compromised host and reach adjacent administrative interfaces.
• Reboot Persistence: The staging logic installs hooks to ensure the tunneling tool automatically reconnects after system restarts, preserving access even if network connections break.

Risk Assessment and Defensive Recommendations

Microsoft researchers reported that while direct lateral movement was not explicitly observed during the initial instances analyzed, the installation of a reverse-tunneling proxy typically signals preparations for hands-on-keyboard intrusion phases. In enterprise security scenarios, establishing a pivot point is frequently followed by privilege escalation attempts, active credential dumping, security software disruption, sensitive data exfiltration, and domain-wide ransomware deployment.

Organizations seeking to mitigate the risk posed by TerminalFix and similar command-line social engineering attacks should consider the following security practices:

Treat Affected Hosts as Pivots: If an endpoint is confirmed to have executed a TerminalFix command string, security teams should immediately isolate the device from the local network. The host should be treated as an active pivot point, and incident responders should examine internal logs for lateral movement attempts originating from that IP address.

Credential Reset Protocols: All local and domain credentials active on or saved to the compromised endpoint must be reset immediately, as attackers with proxy access may capture authentication tokens during network discovery.

PowerShell Restrictions: Organizations should consider enforcing PowerShell execution policies, such as Constrained Language Mode, and implementing Application Control rules (e.g., AppLocker or Windows Defender Application Control) to limit unauthorized script execution and restrict unapproved interactive terminal usage.

User Awareness Programs: Training initiatives should emphasize that legitimate websites and verification services (including CAPTCHA providers) will never require users to open local administrative tools, copy arbitrary terminal commands, or paste scripts into Windows Terminal.

As social engineering techniques shift from simple executable downloads toward interactive, user-assisted script execution, defending the endpoint requires combining traditional network monitoring with user training and script-level visibility.