Microsoft warns of TerminalFix attacks using fake CAPTCHAs, PNG steganography and WebSocket tunnels

A fake verification prompt starts the chain

Microsoft is warning about an attack campaign dubbed TerminalFix, according to a BleepingComputer report summarized in a dev.to post. The chain begins on compromised websites that display a page imitating Cloudflare's Turnstile verification. Instead of solving a puzzle, the visitor is told to open Windows Terminal or PowerShell and paste a "verification" command. By that point the site has already placed malicious PowerShell code on the clipboard, so the user runs the attacker's script themselves.

ZIP download, batch script and DLL side-loading

Once pasted and executed, the command downloads a ZIP archive, unpacks it into C:\ProgramData and runs a batch file named 1.bat. The archive holds a copy of a legitimate Windows executable, LockScreenContentServer.exe, next to a malicious dui70.dll. When the executable launches, it loads the hostile DLL from its own folder — a textbook DLL side-loading setup that lets the payload run beneath a trusted binary. Traffic fetching the ZIP and related artifacts has been observed heading to distribution domains including bestsocialmedianewspapper.com and offlineupdater.com.

Payloads hidden in PNG pixels

The chain's most distinctive trick is steganography. Per the report, PowerShell reconstructs the executable and a split DLL from the RGBA pixel values of three PNG images, then deletes the original pictures. Because the malicious components travel as ordinary-looking images, content inspection tuned to catch executables or archives can miss them entirely. PNG upload traffic is one of the observable signs of this stage.

Persistence and domain reconnaissance

TerminalFix then secures its foothold. It creates a Run key under HKCU, registers a scheduled task that fires every 60 minutes, and marks the malware folder as hidden and system. It proceeds to enumerate the Active Directory environment — domain trusts, Domain Admins membership, user description fields and server names — and sets up a file-monitoring loop that can serve as a command execution trigger.

A Python reverse tunnel into the internal network

To convert the infected PC into a bridge, the chain installs a Python runtime and a script named client.py. Launched via pythonw.exe, client.py relays arbitrary TCP connections from an external command-and-control server to internal targets, multiplexed over a single TLS WebSocket connection to gitnow.dev on port 443. The compromised endpoint effectively becomes a pivot: an attacker outside the perimeter can reach internal systems while the traffic resembles ordinary encrypted web access to one host.

Microsoft's analysis notably did not observe the follow-on stages — privilege escalation, disabling of security tools, data exfiltration or ransomware — in the chains it examined, even though the tunnel clearly paves the way for them.

Detection and hardening

The report lists concrete indicators defenders can hunt for: LockScreenContentServer.exe running outside its normal SystemApps location; dui70.dll sitting in the same folder; randomly named directories under C:\ProgramData; PNG upload requests; new Run keys and scheduled tasks; hidden file attributes applied to program folders; and pythonw.exe invoking client.py. Correlating browser activity with a PowerShell spawn, ZIP extraction, DLL loads, registry changes and a final WebSocket connection reconstructs the full chain.

Suggested mitigations include enabling PowerShell Script Block Logging and Constrained Language Mode, applying application control to block execution from non-standard paths and unknown DLLs, blocking the known C2 infrastructure and suspicious WebSocket traffic, and isolating any confirmed endpoint while treating it as an active pivot. The simplest control of all is user awareness: no legitimate CAPTCHA will ever ask you to paste commands into a terminal.

Why it matters

TerminalFix matters because it stacks techniques that each defeat a common defensive layer. Web-based social engineering bypasses email security entirely; PNG steganography slips past content inspection; abuse of a signed binary undermines naive trust checks; and a TLS WebSocket tunnel hides multi-destination internal access inside what looks like routine HTTPS. It also shows fake-CAPTCHA lures graduating from clipboard-stealer novelties to full network pivoting. Every stage leaves artifacts, but only when PowerShell logging, image-load events, scheduled task and registry monitoring, and proxy visibility are already switched on — precisely the gaps this chain is built to exploit.