TerminalFix: a pasted command that maps your Active Directory

The ClickFix attacks we have written about before ended in a cryptominer or an infostealer — bad, but a smash-and-grab. TerminalFix is a different animal. Microsoft Threat Intelligence disclosed a campaign on August 28 that starts the same way, with a fake CAPTCHA and a pasted PowerShell command, and ends with an attacker holding a network-level proxy into your domain. Same lure, entirely different outcome. If your team's mental model of "paste a command from a website" is still "you might get a miner," update it.

What actually happened

Per Microsoft's write-up, compromised websites serve a fake Cloudflare Turnstile overlay — logo, "Verify you are human" checkbox, spinner — that puts a PowerShell command on the visitor's clipboard. The variant's one change from classic ClickFix is the target: it sends users to Windows Terminal or PowerShell rather than the Run dialog, because multi-line scripts execute far more reliably there.

The chain from there is not amateur work:

• A ZIP drops LockScreenContentServer.exe — a legitimate signed Windows binary — alongside a malicious dui70.dll, both extracted to C:\ProgramData\f47f2a8c21c9df4e and hidden with attrib +h +s.
• The loader resolves the application directory before System32, so the planted DLL wins. Payloads live obfuscated in resource sections and decode in memory.
• Later stages arrive as PNG images. A PowerShell routine reads RGBA pixel values and reconstructs a binary, with the first 8 bytes carrying the payload length as a 64-bit integer.
• Persistence is redundant: a randomized HKCU Run key plus a scheduled task firing every 60 minutes.
• Then it looks around: nltest /domain_trusts, net group "domain admins" /domain, ADSI user enumeration including description harvesting, and systematic pings against named domain controllers, database, backup, and mail servers.
• Finally client.py runs under pythonw.exe with no window, tunneling TCP over a TLS WebSocket to gitnow[.]dev on port 443 with SOCKS5-style address parsing — meaning the C2 can reach any internal host and port the victim machine can see.

Why this matters for your business

One employee, one paste, and the attacker is inside your address space. Not on one laptop — inside. The recon list tells you exactly what they came for: who the domain admins are, which box is the file server, which one is the backup. The tunnel means everything after that runs over port 443 to a domain that looks like a developer tool.

Three things are worth doing this week:

Turn on Windows Terminal's multiline paste warning. Microsoft names it as a mitigation, and it interrupts precisely this attack at step one. It costs nothing.

Constrain PowerShell. AppLocker or Windows Defender Application Control plus script block logging is the difference between "we found it in the logs" and "we never knew." Add the ASR rule that blocks obfuscated scripts while you are in there.

Alert on the specifics. LockScreenContentServer.exe running from anywhere outside System32 is a high-signal, zero-noise detection. So is pythonw.exe opening a persistent outbound 443 connection on a machine where nobody writes Python.

The uncomfortable part: nothing here required a vulnerability. Every step was a legitimate binary, a normal Windows feature, or an ordinary outbound HTTPS connection.

Sources: Microsoft Security Blog, The Hacker News.