TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix.

The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard.

Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command.

After gaining a foothold, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites, but the images also contain concealed payload data. A PowerShell script reads the images’ pixel data: The first eight bytes specify the embedded file’s length, while the remaining data is reconstructed into an executable and two DLL fragments, which are joined on the victim’s disk.

The use of steganography is notable, but does not set TerminalFix apart from other ClickFix campaigns that have used the same method.

What does make TerminalFix different is its payload. One way or another , ClickFix victims usually end up with information-stealing malware of some sort.

TerminalFix instead chains together several mature evasion techniques, including DLL sideloading, steganographic delivery, folder hiding, realistic browser User-Agent rotation, and encrypted WebSocket traffic, rather than relying on one obfuscated PowerShell downloader. Its end goal is also different.

The campaign delivers a payload chain that performs domain-aware reconnaissance before installing a custom, multiplexed reverse TCP tunnel.

This hidden connection can give attackers access to the victim’s network. The infected computer first calls out to the attackers using encrypted web-like traffic over port 443, allowing the “reverse” connection to pass more easily through a company firewall.

In this way, the compromised system creates a secret remote-access doorway from inside the network.

Microsoft has published details about a Windows malware campaign it calls TerminalFix.

The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard.

Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command.

After gaining a foothold, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites, but the images also contain concealed payload data. A PowerShell script reads the images’ pixel data: The first eight bytes specify the embedded file’s length, while the remaining data is reconstructed into an executable and two DLL fragments, which are joined on the victim’s disk.

The use of steganography is notable, but does not set TerminalFix apart from other ClickFix campaigns that have used the same method.

What does make TerminalFix different is its payload. One way or another , ClickFix victims usually end up with information-stealing malware of some sort.

TerminalFix instead chains together several mature evasion techniques, including DLL sideloading, steganographic delivery, folder hiding, realistic browser User-Agent rotation, and encrypted WebSocket traffic, rather than relying on one obfuscated PowerShell downloader. Its end goal is also different.

The campaign delivers a payload chain that performs domain-aware reconnaissance before installing a custom, multiplexed reverse TCP tunnel.

This hidden connection can give attackers access to the victim’s network.