Microsoft identifies ‘TerminalFix’ campaign spreading Python reverse tunnel

Microsoft Threat Intelligence identified a “TerminalFix” social engineering campaign designed to deploy a custom Python-based reverse tunnel implant, granting attackers access to an organization’s internal network, according to a report published Friday.  

TerminalFix is a variant of the ClickFix social engineering technique that instructs victims to copy and paste commands into Windows Terminal or PowerShell rather than the Windows Run dialog, Microsoft researchers explained. The TerminalFix lures are planted on compromised websites, displaying a fake Cloudflare CAPTCHA and instructing visitors to paste the commands in order to proceed to the website.

When the commands are run, fake verification status messages are printed to the terminal output while a ZIP archive is downloaded from attacker infrastructure and a batch file is executed that kicks off the rest of the attack chain.

DLL sideloading is used to hide the malicious activity within trusted, signed processes: a DLL disguised as the Windows DirectUI Engine, dui70.dll, is placed in a directory alongside a legitimate signed LockScreenContentServer.exe executable, causing the executable to sideload the malicious DLL when executed by the batch script.

This DLL runs a PowerShell script that downloads additional payloads in the form of PNG image files. Malicious binaries are embedded within the RGBA channels of the pixel’s images, a technique known as steganography. These binaries are extracted to reconstruct the payloads: an executable and another DLL split across two different images.

The malware establishes persistence through both a registry Run key and a scheduled task that runs every 60 minutes, both added under the name LockScreenContentServer_MuODG5yBM.  

Then, it performs system reconnaissance by collecting system metadata across English, Spanish and German locales, performing domain trust discovery, domain admin enumeration and Active Directory user and computer enumeration, and pinging a list of named servers across common infrastructure roles such as domain controllers, databases, backups, gateways and mail systems to map accessible assets, Microsoft described.  

A “primitive but effective” asynchronous command-and-control is established in the form of a local text file the malware continuously watches for changes, executing any PowerShell commands found there and writing the output to a separate file.

The final payload is the custom Python-based reverse tunnel implant that connects outbound over TLS port 443 and upgrades to a WebSocket, granting the attacker “full SOCKS-style TCP proxy access through the victim’s network,” Microsoft said.

The malware installs a legitimate, signed Python runtime directly from python.org and launches the tunnel without a visible window via pythonw.exe. TCP proxying enables the attacker to reach any accessible internal host or port, with user agents imitating four different browsers randomly selected for each connection.  

“Combined with the reconnaissance data gathered earlier (domain controllers, SQL servers, backup servers, gateway), this turns the compromised machine into a full network pivot point,” Microsoft stated.

To combat this attack, Microsoft recommended restricting PowerShell execution via AppLocker, Application Control for Windows or Group Policy for users who do not need it to perform their job functions, educating employees about ClickFix and its variants, and monitor for DLL sideloading indicators such as LockScreenContentServer.exe executing from anything other than the SystemApps directory.

Organizations that discover indicators of this campaign on one of their systems should assume the attacker has network-level access through the compromised host and rotate all credentials accessible from that machine, Microsoft said.