How TerminalFix creates a reverse-tunnel foothold

Microsoft’s security team identified a new ClickFix-derived malware family named TerminalFix. The threat lures users with a counterfeit Cloudflare CAPTCHA that instructs them to copy a PowerShell command and paste it into Windows Terminal. Once executed, the script downloads a signed executable and a malicious DLL, decodes the DLL in memory, and then launches a custom Python module that opens an encrypted WebSocket tunnel to gitnow.dev:443. This tunnel acts as a persistent outbound channel, allowing attackers to pivot inside the victim’s internal network, launch ransomware, or exfiltrate data.

Detailed attack chain

  1. Fake CAPTCHA lure – A compromised website displays a Cloudflare-style CAPTCHA. The page copies a PowerShell command to the clipboard and asks the user to paste it into Windows Terminal.
  2. Initial payload delivery – The PowerShell script downloads a ZIP archive from the attacker’s server. Inside is a legitimately signed executable (to bypass SmartScreen) and a malicious DLL that is loaded directly in memory.
  3. Steganographic retrieval – The second stage pulls three PNG images from the C2 server. Each image hides fragments of additional executables. A PowerShell routine reassembles the fragments on disk, reconstructing the full payload, including the reverse-tunnel component.
  4. Persistence mechanisms – The malware registers a scheduled task that runs hourly and adds a Registry Run key, ensuring the malicious script survives reboots and user log-offs.
  5. Reconnaissance phase – While active, the implant enumerates Active Directory, probes domain controllers, database servers, backup gateways, and mail systems, gathering information for lateral movement.
  6. Reverse-tunnel establishment – The custom Python module opens an encrypted WebSocket to gitnow.dev:443. The tunnel supports SOCKS5-style proxying, multiplexed connections, rotating User-Agent strings, keep-alive packets, and remote shutdown commands, turning the infected endpoint into a pivot point.

Why the reverse tunnel raises the stakes

Traditional ClickFix attacks drop simple infostealers that harvest credentials. TerminalFix adds a reliable outbound channel that persists as long as the scheduled task runs. This capability expands the attack surface dramatically: threat actors can move laterally, elevate privileges, disable security tools, and exfiltrate data without deploying additional malware drops.

Detection and mitigation recommendations

  • Restrict PowerShell execution – Enforce Constrained Language Mode, enable script-block logging, and block unsigned scripts in Windows Terminal.
  • Monitor scheduled tasks – Alert on tasks that execute PowerShell or scripts every hour, especially those created under SYSTEM or high-privilege accounts.
  • Watch for LockScreenContentServer.exe outside its default path – The binary is benign in C:\Windows\System32 but malicious when placed elsewhere.
  • Network controls – Block outbound WebSocket connections to unknown domains and enforce egress filtering that permits traffic only to approved destinations.
  • Credential hygiene – After confirming an infection, rotate all privileged credentials and audit newly created service accounts.
  • Endpoint protection – Deploy behavior-based EDR solutions that can detect in-memory DLL injection and unusual registry modifications.

Impact on cryptocurrency operations and other high-value targets

Organizations that host cryptocurrency wallets, blockchain nodes, or on-chain analytics platforms often run Windows-based management consoles. A TerminalFix infection on such a host could expose private keys stored locally or grant access to internal APIs that manage transaction signing. The reverse tunnel can also reach isolated blockchain infrastructure that is firewalled from the internet, increasing the risk of unauthorized fund transfers.

Regulatory and compliance considerations

A breach that uses a reverse tunnel may trigger data-protection obligations under GDPR, CCPA, or sector-specific regulations such as the NYDFS Cybersecurity Regulation. Companies must document the incident, assess the scope of data exposure, and report to regulators within mandated timeframes. Failure to do so can result in substantial fines and reputational damage.

What to watch next in TerminalFix evolution

  • Emerging variants – Researchers expect attackers to iterate on the code, possibly adding file-less execution paths or leveraging legitimate cloud services for C2.
  • Supply-chain risks – If the malicious DLL is signed with a compromised code-signing certificate, downstream distributors could inadvertently propagate the payload.
  • Threat-intel sharing – Organizations should share IOCs (hashes, C2 domains, scheduled-task names) through ISACs and trusted platforms to improve collective defense.

Practical steps for security teams

  1. Run a full PowerShell audit – Use Get-EventLog -LogName Microsoft-Windows-PowerShell/Operational to extract recent script executions.
  2. Search for the ZIP download URL – The initial download often uses a short, obfuscated domain; block any outbound DNS queries matching that pattern.
  3. Deploy an on-chain app tracker – Monitoring blockchain activity can reveal if compromised keys are being used; an on-chain app tracker can surface suspicious token movements linked to compromised infrastructure.
  4. Educate users – Reinforce that legitimate CAPTCHAs never require manual command entry. Any prompt to copy-paste PowerShell should be treated as suspicious.

Internal analysis and resources

The original advisory was published on August 31, 2026 and is available on the source site.

Mitigating TerminalFix Reverse Tunnel Risks

Microsoft’s warning underscores the need for organizations to tighten PowerShell controls, monitor scheduled tasks, and enforce strict egress filtering. TerminalFix transforms a typical phishing click into a persistent foothold that can compromise entire networks, including high-value crypto assets. Prompt detection, rapid credential rotation, and proactive threat-intel sharing are essential to mitigate this emerging threat.

Related coverage

Explore more on this topic