TerminalFix Uses Fake CAPTCHAs for Backdoor Deployment

Microsoft has detailed a new malware variant, identified as TerminalFix, which employs sophisticated social engineering tactics to deploy a reverse-tunnel backdoor on Windows systems. This variant, a successor to previous ClickFix campaigns, distinguishes itself by leveraging fake Cloudflare CAPTCHA pages to deceive users into executing malicious commands. Traditional ClickFix campaigns typically directed victims to the Windows Run dialog box, a less sophisticated method. TerminalFix, however, redirects users to Windows Terminal or PowerShell, environments capable of handling more complex command sequences, thereby increasing the probability of successful malware execution.

The attack chain begins with a phishing email containing a link. Upon clicking this link, the user is presented with a convincing replica of a Cloudflare CAPTCHA verification page. This page is designed to appear legitimate, prompting the user to solve the CAPTCHA to proceed. The underlying malicious payload is embedded within the CAPTCHA solving process. When the user interacts with the fake CAPTCHA, they are inadvertently triggering the execution of a malicious script. This script is designed to download and execute the TerminalFix backdoor, which establishes a reverse tunnel connection to a command-and-control (C2) server.

The primary objective of TerminalFix is to establish persistent access to the compromised system. The reverse tunnel functionality allows attackers to bypass network security measures and initiate connections from the compromised machine back to their C2 infrastructure. This enables them to exfiltrate sensitive data, conduct further reconnaissance, or deploy additional malware. The use of Windows Terminal and PowerShell as execution vectors is a notable evolution, as these tools are integral to system administration and are less likely to raise immediate suspicion compared to the Run dialog. The sophistication of the fake CAPTCHA pages further enhances the malware's ability to evade detection and trick unsuspecting users.

Microsoft's analysis indicates that the TerminalFix campaigns are part of a broader trend where threat actors are increasingly incorporating advanced social engineering techniques and leveraging legitimate system tools to achieve their objectives. The effectiveness of this attack relies heavily on the user's trust in seemingly innocuous web pages and their familiarity with system utilities. Security researchers emphasize the importance of user education regarding phishing attempts and the verification of website authenticity, especially when prompted to complete security challenges or execute commands. The ongoing evolution of such malware highlights the persistent need for robust endpoint security solutions and vigilant cybersecurity practices.