TerminalFix: Fake CAPTCHA to PNG Steganography and WebSocket Reverse Tunnels

1. Basic Information

• Article Title: Microsoft warns of TerminalFix attacks deploying reverse tunnels
• Publisher: BleepingComputer
• Publication Date: 2026-08-31
• Original Source: BleepingComputer
• Related Source: Microsoft Security Research
• Related Malware / Threat Groups / CVEs / Products: TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active Directory
• Severity: High

2. Executive Summary

TerminalFix uses a fake Cloudflare CAPTCHA on compromised websites to trick users into pasting PowerShell commands. It then performs DLL side-loading, extracts payloads from PNG images, establishes dual persistence, and enumerates Active Directory to set up a reverse WebSocket tunnel that reaches the internal network.

3. Attack Flow

From Fake CAPTCHA to Network Pivot Point

1. A compromised website displays a fake Cloudflare Turnstile page and copies malicious PowerShell code to the clipboard.
2. The user pastes the code into the terminal, extracting a ZIP file to C:\ProgramData and executing 1.bat.
3. The legitimate LockScreenContentServer.exe side-loads a malicious dui70.dll.
4. PowerShell restores the executable and DLL fragments from three PNG images.
5. The infection creates a Run key and a 60-minute scheduled task, then hides the folder.
6. It enumerates Active Directory and internal servers, setting up a file-monitoring command execution loop.
7. It deploys the Python runtime and client.py to relay arbitrary TCP traffic from the external C2 to internal targets over a TLS WebSocket.

4. Attacker Position and Execution Location

• External attackers direct victims to view compromised websites.
• After execution, the compromised endpoint is operated as a pivot point between the external C2 and the internal network.

5. Visibility for Victims and Administrators

Victims

• Tricked into opening the terminal from a realistic Cloudflare verification screen and pasting multi-line verification commands.

Administrators

• Observable indicators include random-name folders in C:\ProgramData, LockScreenContentServer.exe running from a non-standard path, dui70.dll, PNG POST requests, Run keys, scheduled tasks, and pythonw.exe.

6. Conditions for Success and Failure

Conditions for Success

• The user executes PowerShell following the fake CAPTCHA instructions.
• The endpoint successfully downloads the ZIP, PNGs, and Python, and application control does not block side-loading.
• WebSocket connections to gitnow.dev:443 are allowed.

Failure Conditions / Risk Mitigation

• The user refuses the CAPTCHA that asks to paste commands into the terminal.
• PowerShell is restricted with Script Block Logging and Constrained Language Mode enabled.
• Execution of LockScreenContentServer.exe from non-standard paths, unknown DLLs, and pythonw.exe running client.py is blocked.
• Known C2 infrastructure and suspicious WebSockets are blocked.

7. What Happens Upon Success

• Persistent code execution on the endpoint.
• Enumeration of Active Directory and critical servers.
• Arbitrary TCP tunneling through the infected endpoint to reach the internal network.
• A foothold established for subsequent credential theft, lateral movement, and data exfiltration (though subsequent success was not observed in the report).

8. Observable Logs

• Email: The primary entry point is compromised websites; public information does not specify if email was used.
• Proxy/SWG/DNS: Traffic fetching ZIP files and PNG POST requests, along with connections to gitnow.dev, bestsocialmedianewspapper.com, and offlineupdater.com.
• Endpoint/EDR: powershell.exe -> cmd.exe -> 1.bat -> LockScreenContentServer.exe, dui70.dll in the same folder, Run keys, scheduled tasks, attrib +h +s, and pythonw.exe client.py.
• Identity/IdP: Suspicious authentication occurring after domain trust, Domain Admins, and user description enumeration.
• SaaS/Cloud: Check for new connections from the affected endpoint to cloud management consoles or SaaS applications.
• Network: TLS WebSockets to gitnow.dev:443, showing pivot behavior where multiple internal destinations are contacted over a single connection.

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): Only the fake Cloudflare CAPTCHA display or malicious PowerShell clipboard copy was identified; execution was not confirmed.
• User Action Confirmed: The user pasted and executed the command in Windows Terminal or PowerShell.
• Initial Execution Confirmed: ZIP extraction, 1.bat, LockScreenContentServer.exe, and the loading of dui70.dll were confirmed.
• Malware Execution or Authentication Success Confirmed: Payload restoration from PNGs, persistence setup, client.py startup, or C2 connection was confirmed.
• Information Theft or Session Compromise Confirmed: Credentials or files were acquired or exfiltrated. Microsoft's analysis did not observe this stage.
• Subsequent Compromise Confirmed: Internal connections via tunnels, lateral movement, privilege escalation, or ransomware were confirmed. Not observed in the analysis report.

10. Investigation Playbook

• Trigger: Detect PowerShell execution following a fake CAPTCHA, LockScreenContentServer.exe in a non-standard path, or a client.py reverse tunnel.
• Initial Check: Preserve browser history, clipboard origin, PowerShell Script Block, ZIP file, extraction path, and process tree.
• Endpoint: Verify dui70.dll, PNG payloads, Run keys, scheduled tasks, hidden attributes, file-monitoring loops, and the Python runtime.
• Authentication & Cloud: Check for credentials used on the endpoint, Domain Admin sessions, and cloud/SaaS authentication, then revoke them.
• Subsequent Activity: Investigate WebSocket destinations, internal connections, enumeration targets, additional payloads, and data transmission.
• Containment: Isolate the endpoint, block the C2, remove Run keys and tasks, and reset exposed credentials. Treat the compromised endpoint as a pivot point.
• Classification: Distinguish between browsing, user execution, DLL execution, persistence, C2, reverse tunnels, internal connections, and information compromise.

11. Defense and Detection Ideas

• Single Event: LockScreenContentServer.exe launches from outside C:\Windows\SystemApps and loads dui70.dll from the same folder.
• Timeline Correlation: Correlate browser activity -> PowerShell -> ZIP -> DLL side-loading -> PNG POST -> Run key / scheduled task -> pythonw.exe -> WebSocket.
• Hunting: Search for gitnow.dev, the two distribution domains, known hashes, random-name folders in C:\ProgramData, and client.py --server --uuid.
• Log Gaps: Missing PowerShell Script Blocks, Image Loads, scheduled tasks, registry modifications, or WebSocket logs make it difficult to trace the multi-stage chain.
• Priority Actions: Prioritize PowerShell/Terminal controls, application control, non-standard path DLL monitoring, C2 blocking, and user security awareness training.

12. Facts / Inference / Hypothesis

Facts

• A fake Cloudflare Turnstile screen copies malicious PowerShell to the clipboard and prompts users to paste it into Windows Terminal or PowerShell.
• The ZIP is extracted to C:\ProgramData, and legitimate LockScreenContentServer.exe loads malicious dui70.dll from the same folder.
• PowerShell restores the executable and a split DLL from the RGBA values of three PNG images, then deletes the original images.
• Persistence is established via an HKCU Run key and a 60-minute scheduled task, enumerating domain trust, Domain Admins, user descriptions, and server names.
• pythonw.exe launches client.py to relay multiple arbitrary TCP connections over a TLS WebSocket to gitnow.dev:443.
• Microsoft has not observed privilege escalation, security disabling, data exfiltration, or ransomware deployment following the tunnel in the analyzed chains.

Inference

• If the infected endpoint is domain-joined, attackers can continuously probe and connect to internal servers from the external network by combining enumeration results with arbitrary TCP tunnels.

Hypothesis

• Variants using the same loader or modified C2 infrastructure may appear, but threat actor attribution and final objectives cannot be definitively concluded from public information.

13. MITRE ATT&CK Mapping

• T1189 Drive-by Compromise (High): Compromised websites displayed fake CAPTCHAs.
• T1059.001 Command and Scripting Interpreter: PowerShell (High): Multi-stage processing started from user-pasted PowerShell code.
• T1574.002 Hijack Execution Flow: DLL Side-Loading (High): LockScreenContentServer.exe loaded malicious dui70.dll.
• T1027.003 Obfuscated Files or Information: Steganography (High): Payloads were split and hidden within PNG RGBA values.
• T1053.005 Scheduled Task/Job: Scheduled Task (High): Legitimate binaries were re-executed every 60 minutes.
• T1572 Protocol Tunneling (High): Arbitrary TCP was relayed over TLS WebSockets.

14. Unknowns and Further Investigation

• Number of compromised organizations, initial compromised websites, and actions performed by attackers after establishing tunnels.

15. Impact on SOCs

This attack chain can deploy to multilingual endpoints including Japanese environments, and tricks involving pasting multi-line commands into Windows Terminal are effective globally. Monitor the execution path of LockScreenContentServer.exe, PNG retrieval, Run keys, scheduled tasks, pythonw.exe, and WebSockets as a cohesive sequence.

16. Target Audience Summary

• For SOCs: Correlate non-standard path LockScreenContentServer.exe and dui70.dll, PNG POST requests, Run keys, 60-minute tasks, pythonw.exe client.py, and gitnow.dev.
• For Administrators: Restrict PowerShell and Windows Terminal to necessary user roles, and enable application control and Script Block Logging.
• For Users: If a CAPTCHA prompts you to paste commands into the terminal or PowerShell, do not run them. Close the page and report it.