News › security
By Zayden R., August 30, 2026
Microsoft reveals TerminalFix, a new malware variant using fake Cloudflare CAPTCHAs to deploy a reverse-tunnel backdoor through PowerShell. This multi-stage attack targets organizations, exploiting DLL sideloading and steganography.
Microsoft has disclosed details of a malware campaign, TerminalFix, which deceives users into executing malicious PowerShell commands by presenting fake Cloudflare CAPTCHA verifications. This sophisticated attack matters to engineers because it utilizes compromised websites to initiate a multi-stage process that culminates in a reverse-tunnel backdoor, providing persistent network-level proxy access.
According to Microsoft security researchers, TerminalFix is a variant of the ClickFix malware. Unlike its predecessors that guided victims to the Windows Run dialog, TerminalFix directs them to Windows Terminal or PowerShell, increasing the likelihood of executing complex scripts successfully. The campaign targets various sectors and leverages DLL sideloading, steganographic payload extraction, and extensive Active Directory reconnaissance.
The attack begins when users visit compromised websites and are prompted to execute a malicious PowerShell command. This command downloads a ZIP archive containing a legitimate binary, 'LockScreenContentServer.exe', and a rogue DLL, 'dui70.dll', initiating a DLL sideloading attack. This sideloaded DLL retrieves further payloads hidden within PNG images from external domains like 'bestsocialmedianewspapper[.]com' and 'offlineupdater[.]com'.
Persistence is established through Registry Run keys and scheduled tasks, while the malware performs domain reconnaissance, including system metadata collection and Active Directory user and computer searches. The Python-based reverse-tunnel command-and-control implant, 'client.py', tunnels arbitrary TCP traffic to attacker-controlled infrastructure via an encrypted WebSocket channel.
This attack is a stark reminder for engineers to maintain vigilance against social engineering tactics and ensure robust network defenses. Regularly updating security measures and educating users can mitigate risks posed by such sophisticated malware.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.