Microsoft has unveiled a new variant of the ClickFix malware, termed TerminalFix, which deceives users into executing harmful commands within Windows Terminal or PowerShell. This method enhances the probability of running intricate multi-line scripts successfully, according to Microsoft’s security researchers.
How TerminalFix Operates
TerminalFix targets various sectors by using compromised websites to display counterfeit Cloudflare CAPTCHA verifications. These fake CAPTCHAs trick users into copying and executing malicious PowerShell commands. The attack is a complex, multi-stage process, involving DLL sideloading and steganography to extract payloads, extensive reconnaissance of Active Directory, and the installation of a custom reverse-tunnel implant for persistent network access.
The PowerShell script downloads a ZIP file containing a legitimate executable and a malicious DLL to initiate a DLL sideloading attack. This rogue DLL retrieves subsequent payloads hidden within PNG images from specific domains, ensuring the attacker’s continued presence on the infected system through registry keys and scheduled tasks.
Exploring the Backdoor Capabilities
TerminalFix’s backdoor, identified as “client.py”, is capable of tunneling TCP traffic to attacker-controlled servers via an encrypted WebSocket channel. This setup allows the attacker’s command-and-control server to access any host within the victim’s network. During reconnaissance, the malware collects system metadata, performs domain trust discoveries, enumerates domain admins, searches Active Directory users and computers, and maps the internal network topology by pinging servers.
The malware includes a persistent PowerShell loop that monitors a text file for new commands, executes them, and logs the results. This feature is particularly concerning as it provides attackers with direct access to an organization’s internal network, potentially enabling further privilege escalation and data exfiltration.
Mitigation and Prevention Strategies
Microsoft emphasizes the severity of TerminalFix, noting its potential to compromise enterprise environments by bypassing security measures and deploying ransomware. To counter this threat, organizations are advised to restrict PowerShell and Run dialog access for standard users using tools like AppLocker or Windows Application Control. Additionally, monitoring for DLL sideloading indicators and training employees about ClickFix threats can enhance security posture.
Implementing PowerShell script block logging is also crucial for detecting and analyzing obfuscated or encoded commands, providing a vital line of defense against such sophisticated intrusions.
