Microsoft has disclosed particulars of a brand new ClickFix variant, dubbed TerminalFix, that goals to trick customers into operating a malicious command in Home windows Terminal or PowerShell.
“Whereas conventional ClickFix campaigns direct victims to the Home windows Run dialog, TerminalFix campaigns apply the identical approach however direct customers to Home windows Terminal or PowerShell as an alternative, rising the chance that advanced, multi-line scripts execute efficiently,” Microsoft safety researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan mentioned in an evaluation printed this week.
The marketing campaign, focusing on organizations throughout a number of sectors, leverages compromised web sites as a place to begin to serve pretend Cloudflare CAPTCHA verifications that immediate unsuspecting web site guests to repeat and execute a malicious PowerShell command.
The assault chain, per the Home windows maker, is a classy multi-stage course of that leverages DLL sideloading, steganographic payload extraction, intensive Lively Listing reconnaissance, and a bespoke customized reverse-tunnel implant that grants the attacker persistent, network-level proxy entry by way of the contaminated machine.
Particularly, the PowerShell command is designed to obtain a ZIP archive containing a official binary (“LockScreenContentServer.exe”) and a rogue DLL (“dui70.dll”) with the intention to provoke a DLL sideloading assault.
The sideloaded DLL is chargeable for retrieving next-stage payloads hidden inside PNG photographs from exterior domains (“bestsocialmedianewspapper[.]com” or “offlineupdater[.]com”), establishes persistence through each Registry Run keys and scheduled duties, carries out area reconnaissance, after which deploys a Python-based reverse-tunnel command-and-control (C2) implant.
The backdoor (“consumer.py”) is provided to tunnel arbitrary TCP visitors again to attacker-controlled infrastructure (“gitnow[.]dev:443”) by way of an encrypted WebSocket channel, in addition to allow the C2 server to achieve any host seen from the sufferer’s community.
The reconnaissance section entails the next steps –
- Acquire system metadata
- Carry out area belief discovery, area admin enumeration, and Lively Listing consumer and pc searches
- Ping named servers to map the interior community topology
The assault additionally delivers a persistent PowerShell file-watch loop that screens a textual content file for brand spanking new instructions, executes them through Invoke-Expression, and writes outcomes to an output file.
“The sort of intrusion is especially harmful as a result of it offers attackers with direct entry to a company’s inner community by way of the reverse tunnel,” Microsoft mentioned. “The noticed reconnaissance and reverse-tunnel functionality may allow an attacker to establish and attain extra techniques from a compromised host.”
The tech large has warned that such entry may be abused additional to escalate privileges, disarm safety controls, exfiltrate delicate information, and deploy ransomware, making TerminalFix a critical risk to enterprise environments.
To mitigate the risk, it is suggested to limit PowerShell and Run dialog execution for traditional customers by way of AppLocker, Software Management for Home windows, or Group Coverage; contemplate blocking or auditing the Home windows Run dialog (“Win+R”) if it is not required; monitor for DLL sideloading indicators; practice staff to maintain an eye fixed out for ClickFix assaults; and allow PowerShell script block logging to detect and analyze obfuscated or encoded instructions.
