Fake CAPTCHA attack hides malware in PNGs, drops reverse tunnel into your network

A new social engineering campaign dubbed TerminalFix is weaponizing the familiar "verify you are human" CAPTCHA to push malware hidden inside PNG image files, then drops a custom reverse tunnel that gives attackers persistent access to the victim's network. Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan detailed the multi-stage chain, which abuses Windows Terminal and PowerShell instead of the classic Run dialog. The technique is the latest evolution of ClickFix, an initial access method that has become wildly popular among attackers because it turns the target into the person who runs the malicious code.

The attack begins when a victim interacts with a phony overlay that spoofs the Cloudflare CAPTCHA "verify you are human" checkbox and includes a Cloudflare logo. A fake verification command is copied to the clipboard, and when the user pastes it into Windows Terminal or PowerShell, it runs a hidden PowerShell script that prints a fake "Starting Cloudflare verification..." message and downloads a ZIP archive from an attacker-controlled server. The archive is extracted under C:\ProgramData, and a batch file launches LockScreenContentServer.exe, a legitimate signed Windows executable that acts as the DLL sideloading host for a second file, dui70.dll. That file purports to be a "Windows DirectUI Engine" but is actually the malicious payload, which executes a second-stage PowerShell script once it is sideloaded.

The second PowerShell script downloads additional payloads hidden inside PNG images, a technique called steganography that makes file and content-type inspection more difficult. In an attempt to further obfuscate the payload and avoid detection, the attacker split the payload into multiple PNGs. The script downloads three images, extracts an executable from the first image and two halves of a DLL from the second and third images, and then reassembles the components on disk. "After extraction, the source images are deleted to reduce forensic artifacts," the Microsoft researchers wrote. That deletion step is a deliberate anti-forensic move, making it harder for incident responders to recover the original malicious components.

TerminalFix is the latest variant of ClickFix, a social engineering technique that tricks users into running malicious commands by promoting them with a phony fix or CAPTCHA verification. Traditional ClickFix points victims to the Windows Run dialog, but TerminalFix directs them to Windows Terminal or PowerShell, which increases the likelihood that they will unknowingly run multi-line scripts on their own computers. The shift matters because security teams have spent years training users to be wary of Run dialog warnings, while Terminal and PowerShell are often treated as trusted tools for developers and IT staff. That trust is exactly what the attacker is exploiting.

The malware establishes redundant persistence through both HKCU Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes to ensure it survives reboots. It then performs reconnaissance on the compromised machine, scooping up system information across multiple language configurations including English, Spanish, and German. It also performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches, while pinging targeted, named servers. "The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems," according to the threat hunters. "This probing could help an attacker identify accessible target systems for follow-on activity."

Next, the malware drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. This allows the attacker to execute additional PowerShell commands by writing them to the text file. Finally, the attacker deploys a custom, Python-based reverse-tunnel implant. The tunnel launches with no visible window via pythonw.exe, and it sets up a reverse WebSocket tunnel to gitnow[.]dev:443. This implant, combined with earlier reconnaissance data, gives the attacker SOCKS-style TCP proxy access through the victim's network. The persistence mechanisms mean a single pasted command can become a standing foothold that survives reboots and gives the attacker a reliable way back in.

Microsoft declined to answer The Register's questions, including how many organizations were targeted and victimized in this TerminalFix campaign, and which attacker or criminal crew is responsible. That silence underscores how hard it is to attribute and scope ClickFix-style campaigns, which often rely on commodity infrastructure and rapidly shifting payloads. For security teams, the practical takeaway is that user training alone is not enough. Microsoft recommends restricting PowerShell and Run dialog execution, and either blocking or auditing the Windows Run dialog (Win+R) if it is not needed for daily work. Organizations should also train employees on how to look for ClickFix tactics, like fake CAPTCHA verification pages that tell them to paste commands into Terminal or the Run dialog.

The TerminalFix campaign is a reminder that initial access methods evolve quickly and that the most effective attacks now combine social engineering with living-off-the-land techniques and steganography to evade detection. For CISOs and IT leaders, the question is not whether users will encounter a fake CAPTCHA, but whether the surrounding controls can absorb the damage when one user clicks. The multi-stage design, with payloads split across PNGs and deleted after extraction, is specifically built to frustrate forensic analysis and content inspection. That makes the window for detection narrow, and the cost of a single successful paste potentially severe.