Microsoft alerts on TerminalFix attacks using reverse tunnels
Microsoft warns of TerminalFix malware that exploits Windows Terminal and PowerShell via fake CAPTCHA prompts to create persistent reverse tunnels on compromised systems.
Why it matters
TerminalFix leverages trusted Windows tools to establish persistent remote access covertly, increasing the complexity of detecting and responding to intrusions.
SOC impact
Detection should focus on identifying unusual PowerShell command executions triggered by deceptive user interactions and monitoring for reverse tunnel activity through Windows Terminal. Investigate any irregular remote connections and review the use of Cloudflare CAPTCHA prompts in unexpected contexts.
Recommended actions
- Identify systems running Windows Terminal and PowerShell with unusual command activity
- Monitor network telemetry for reverse tunnel connections originating from endpoints
- Review user interaction logs for unusual CAPTCHA prompt executions
- Analyze PowerShell script executions for signs of obfuscation or external command triggers
- Assess the presence of TerminalFix using telemetry and endpoint detection tools
Executive Summary
Microsoft has issued an alert concerning a new variant of ClickFix malware named TerminalFix. This variant employs fake Cloudflare CAPTCHA prompts to deceive victims into executing malicious PowerShell commands. The malware leverages Windows Terminal to establish reverse tunnels, which enables attackers to maintain persistent access on affected systems.
This technique exploits legitimate Windows utilities, making detection challenging and presenting operational challenges in identifying and mitigating unauthorized access. Security teams should focus on unusual PowerShell activity, network connections indicative of reverse tunnels, and suspicious user interaction patterns related to CAPTCHA prompts. Proper monitoring and analysis of these indicators will help clarify the scope and impact of possible TerminalFix infections.
SOC Impact
Detection should focus on identifying unusual PowerShell command executions triggered by deceptive user interactions and monitoring for reverse tunnel activity through Windows Terminal. Investigate any irregular remote connections and review the use of Cloudflare CAPTCHA prompts in unexpected contexts.
Detection and Exposure Validation Focus
- Identify systems running Windows Terminal and PowerShell with unusual command activity
- Monitor network telemetry for reverse tunnel connections originating from endpoints
- Review user interaction logs for unusual CAPTCHA prompt executions
- Analyze PowerShell script executions for signs of obfuscation or external command triggers
- Assess the presence of TerminalFix using telemetry and endpoint detection tools
Why It Matters
TerminalFix leverages trusted Windows tools to establish persistent remote access covertly, increasing the complexity of detecting and responding to intrusions.