14:04Machine-translated from Azerbaijani by AIRead in Azerbaijani
TerminalFix Opens a Backdoor Into Networks Through a Fake Cloudflare CAPTCHA
Microsoft has warned about an ongoing malicious campaign called TerminalFix. The attack spreads through compromised websites and displays a fake Cloudflare CAPTCHA verification to users. Visitors are asked to copy a special command and run it in Windows Terminal or PowerShell, supposedly to prove that they are human. In reality, the PowerShell command installs a backdoor on the computer.
The TerminalFix method resembles previously used ClickFix attacks. While the classic version directed victims to the Windows Run dialog, the new campaign uses Windows Terminal and PowerShell. This change increases the likelihood that complex, multiline scripts will run successfully. The campaign’s goal is not to deploy a simple information-stealing program, but rather a more capable access mechanism. After the user runs the command, two files are downloaded to the system. One is a legitimate executable, while the other is a malicious DLL file. The legitimate program launches the DLL through sideloading, and that file deploys a hidden client.py payload. The custom Python implant establishes an encrypted WebSocket connection to the attackers’ server and provides SOCKS5 proxy access to the internal network.
This implant can turn an infected device into a gateway to an organization’s internal network. Attackers can connect to internal computers, inspect domain controllers, and remotely execute commands. The malware retains access even after the computer is restarted. The reverse tunnel makes it possible to move from the compromised device to other systems and explore the network. Microsoft has not yet observed the attackers moving to other systems within the network. It is therefore unclear exactly how the access is being used. The company recommends that organizations investigate infected devices as potential gateways and check whether passwords or other credentials have been leaked. At a later stage, the attackers could escalate privileges, disable security tools, steal data, and deploy ransomware across the network.
The TerminalFix method resembles previously used ClickFix attacks. While the classic version directed victims to the Windows Run dialog, the new campaign uses Windows Terminal and PowerShell. This change increases the likelihood that complex, multiline scripts will run successfully. The campaign’s goal is not to deploy a simple information-stealing program, but rather a more capable access mechanism. After the user runs the command, two files are downloaded to the system. One is a legitimate executable, while the other is a malicious DLL file. The legitimate program launches the DLL through sideloading, and that file deploys a hidden client.py payload. The custom Python implant establishes an encrypted WebSocket connection to the attackers’ server and provides SOCKS5 proxy access to the internal network. This implant can turn an infected device into a gateway to an organization’s internal network. Attackers can connect to internal computers, inspect domain controllers, and remotely execute commands. The malware retains access even after the computer is restarted. The reverse tunnel makes it possible to move from the compromised device to other systems and explore the network. Microsoft has not yet observed the attackers moving to other systems within the network. It is therefore unclear exactly how the access is being used. The company recommends that organizations investigate infected devices as potential gateways and check whether passwords or other credentials have been leaked. At a later stage, the attackers could escalate privileges, disable security tools, steal data, and deploy ransomware across the network.