475/69 Tuesday, September 1, 2026
Microsoft’s security research team has warned about the spread of a new cyberattack campaign named TerminalFix, an evolution of the ClickFix technique, targeting organizations across multiple sectors. The attack tricks users into copying malicious commands and running them in Windows Terminal or PowerShell through fake Cloudflare CAPTCHA verification pages hosted on compromised websites. By shifting from tricking users into running commands through the Run dialog to using PowerShell, threat actors can execute more complex multi-line scripts, putting enterprise networks at risk of unauthorized network-level access.
The attack chain involves multiple stages. It begins with a PowerShell command that downloads a ZIP file containing a legitimate program, LockScreenContentServer.exe
, together with a malicious DLL file named dui70.dll
to perform DLL sideloading. The malicious DLL then retrieves malware hidden inside a PNG image from an external domain and establishes persistence through Registry Run keys and scheduled tasks. The malware also performs reconnaissance of the internal network and Active Directory to identify servers and administrator accounts. It then installs a Python-based backdoor, client.py
, to create an encrypted WebSocket reverse tunnel to the attacker’s command-and-control server, allowing the attackers to infiltrate systems, steal data, or deploy ransomware across the network.
To reduce the risk from this threat, administrators and organizations should consider restricting the use of PowerShell and the Run dialog for general users through AppLocker, Application Control for Windows, or Group Policy, together with enabling PowerShell Script Block Logging to detect obfuscated commands. Organizations should also regularly monitor for indicators of DLL sideloading and strengthen cybersecurity awareness among personnel, emphasizing the risks of copying commands from untrusted webpages and running them on their computers to prevent users from falling victim to this type of attack.
Source: https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html