A fake CAPTCHA gets the user to open a tunnel into the network

Microsoft Threat Intelligence has followed a campaign it calls TerminalFix, a variant of the widely used ClickFix technique, against organisations in several industries. Compromised websites display a fake Cloudflare CAPTCHA. It asks the visitor to paste a command into Windows Terminal or PowerShell, which is to say it asks the visitor to do the job an attacker would otherwise need a vulnerability for.

The command downloads a ZIP archive. From there a signed Windows binary, LockScreenContentServer.exe, is used to sideload a malicious dui70.dll. Later stages recover payloads hidden inside PNG images, leave behind registry entries and scheduled tasks, and enumerate Active Directory and named infrastructure. The chain ends with a Python implant that connects out over TLS WebSockets and can proxy arbitrary TCP traffic to systems the infected host can reach. Microsoft observed no downstream activity through the tunnel in the chain it analysed, and the report carries indicators, Defender detections and ready-made hunting queries.

What this means for you if you manage the Windows clients

It is worth pausing at how little this attack requires. No vulnerability is exploited and no patch closes the hole, because the hole is that a person does as they are told. Our assessment is that the controls that work here are the ones that make pasting a command into a terminal window difficult, and the ones that make it visible when somebody does it anyway. A signed Windows file loading the malicious code also means that controls looking for unfamiliar filenames stay quiet.

The tunnel is the part to take seriously. It turns an ordinary client into an entrance to everything that machine can reach, and how much that is depends on your segmentation and on what you let out. Microsoft did not see what the attackers used the tunnel for, so the consequence is unknown rather than absent. If you have clients that reach both the office network and the operations network, those are the machines worth looking at first.

Berigo recommends

• Tell your users that no genuine CAPTCHA ever asks them to paste something into a terminal window.
• Limit who can use Windows Terminal and PowerShell, and log what gets run.
• Look for LockScreenContentServer.exe running from anywhere but its usual directory.
• Review outbound WebSocket traffic, and question connections that stay open for a long time.
• Use the indicators and hunting queries in the Microsoft report to search backwards through your logs.