TerminalFix Uses Fake CAPTCHAs and Reverse Tunnels to Turn Endpoints into Network Proxy Pivots

Threat intelligence researchers have disclosed details on an active intrusion campaign dubbed TerminalFix, a sophisticated variant of the ClickFix attack paradigm targeting multiple industry sectors. The attack sequence initiates on compromised websites displaying counterfeit Cloudflare Turnstile CAPTCHA verification prompts. Rather than directing targets toward the Windows Run dialog as seen in earlier campaigns, victims are instructed to copy and execute an obfuscated PowerShell command within Windows Terminal or PowerShell. The script downloads an archive containing a legitimate Windows executable alongside a malicious library to achieve DLL sideloading. The payload extracts steganographic components from external images, establishes persistence through scheduled tasks and registry keys, executes thorough Active Directory reconnaissance, and deploys a Python-based reverse-tunnel implant communicating via encrypted WebSockets. Unlike traditional malware campaigns that merely drop infostealers to harvest local browser credentials, TerminalFix fundamentally weaponizes the workstation as an ingress proxy into the enterprise perimeter. By leveraging living-off-the-land techniques and establishing an outbound reverse tunnel, attackers effectively bypass inbound network firewalls and NAT boundaries. The established connection grants remote operators persistent, interactive TCP forwarding capabilities across internal subnets. Consequently, a single developer or operator executing the script on a domain-joined machine can expose sensitive internal services, code repositories, databases, and administrative consoles that were otherwise shielded from the public internet. This development reflects a wider shift in the enterprise threat landscape where perimeter hardening and automated browser controls have driven threat actors to manipulate end-user authority directly. As organizations adopt secure cloud architectures and zero-trust identity frameworks, attackers are focusing on the initial access broker model through deceptive interface hijacking. By disguising malware execution as standard security verification workflows, adversaries bypass email security gateways and static file filters while abusing native administrative tools to blend in with legitimate developer and administrative activity. For enterprise practitioners and platform engineers, mitigating this threat necessitates tightening endpoint execution policies and visibility. Security teams should enforce application control mechanisms to restrict unauthorized PowerShell execution for standard accounts and monitor for suspicious DLL sideloading patterns within user-writable paths like ProgramData. Comprehensive PowerShell Script Block Logging must be enabled to ensure rapid detection of multi-line payloads. Furthermore, teams must implement robust microsegmentation and continuous egress inspection to detect anomalous WebSocket and SSH reverse-tunnel connections originating from client endpoints.