Hackers are employing deceptive tactics involving a fraudulent CAPTCHA to gain access to corporate networks. This method, disguised as a Cloudflare verification, serves as an entry point for attackers.
Understanding the TerminalFix Campaign
The TerminalFix initiative starts on compromised websites, directing users to execute a fake verification command within Windows Terminal or PowerShell. This social engineering tactic is aimed at multiple industry sectors and involves the unsuspecting victim executing commands that retrieve a ZIP archive. The archive is then unpacked in the ProgramData directory, initiating a batch file that facilitates attacker access.
Microsoft’s security analysts have identified TerminalFix as an advanced version of the ClickFix malware, targeting a variety of industries. The campaign leverages techniques such as DLL sideloading and data concealment within images, along with a customized reverse tunnel.
Mechanics of the Fake CAPTCHA Attack
The fraudulent CAPTCHA appears like a routine security check, misleading users into pasting harmful PowerShell commands. This action initiates a multi-line script in Terminal or PowerShell, bypassing the need for browser exploits and exploiting user trust.
The downloaded archive includes a legitimate signed application alongside a malicious DLL. When executed, Windows prioritizes loading the harmful DLL, allowing malicious code execution without raising immediate suspicion. This process involves downloading PNG images from attacker-controlled sites to extract hidden components.
Implications and Defensive Measures
Once persistence is established, TerminalFix conducts extensive reconnaissance within the network, identifying valuable systems and connected devices. The attack concludes by deploying a Python runtime that operates covertly, establishing an encrypted WebSocket connection. This connection functions as a proxy, facilitating unauthorized traffic through the compromised network.
Organizations must respond swiftly to such breaches, treating them as potential network-wide threats. Recommendations include monitoring for unusual DLL loads, restricting PowerShell usage, and reinforcing endpoint protections. Blocking associated domains and isolating affected devices can mitigate the attack’s impact.
Educating employees about the dangers of fake CAPTCHA prompts and enforcing strict security protocols are vital. Implementing layered defenses and continuous monitoring can help reduce vulnerabilities and enhance organizational resilience against such sophisticated cyber threats.
