Fake Cloudflare CAPTCHA Used to Deploy Reverse Tunnels

Key Takeaways

• A new campaign, dubbed “TerminalFix,” leverages fake Cloudflare CAPTCHAs to trick users into executing malicious commands.
• The attack deploys a sophisticated multi-stage reverse tunnel, providing attackers with persistent access to corporate networks.
• The threat actors utilize social engineering, DLL sideloading, and steganography to conceal their operations.
• Multiple industry sectors have been targeted, with the potential for data theft, system tampering, or ransomware deployment.
• Immediate action and enhanced security measures are crucial to mitigate the risks posed by this stealthy intrusion method.

Cyber adversaries are exploiting a deceptive Cloudflare CAPTCHA imitation to establish covert access routes into corporate networks, transforming a routine security verification into a critical entry point for sophisticated attacks. This campaign, named TerminalFix, represents an advanced evolution of previous threats, demonstrating a high degree of stealth and persistence.

The TerminalFix campaign initiates on compromised websites, where unsuspecting visitors are presented with a fraudulent Cloudflare verification screen. Users are then prompted to paste a seemingly innocuous command into their Windows Terminal or PowerShell environment. This user interaction is pivotal, as it triggers a multi-stage infection chain designed to infiltrate and map the target network, ultimately establishing a persistent reverse tunnel back to the attackers.

According to a comprehensive report, TerminalFix is a more potent iteration of the ClickFix variant, observed actively targeting organizations across various industries. The attack combines social engineering tactics with advanced technical maneuvers, including DLL sideloading, data hidden within images (steganography), and a custom-built reverse tunnel to maintain a covert presence within compromised systems.

A successful infection can transform a single compromised workstation into a strategic pivot point, granting attackers access to interconnected internal systems, including critical infrastructure. While direct “hands-on” actions post-compromise have not been fully documented by researchers, the established access could facilitate a range of malicious activities, from data exfiltration and tampering with security controls to the deployment of ransomware.

Hackers Use Fake Cloudflare CAPTCHA

The initial lure is designed to appear highly authentic. A legitimate-looking webpage briefly loads before being replaced by a convincing, yet counterfeit, Cloudflare Turnstile screen. This fake verification prompt features a checkbox and a loading animation, mimicking the standard Cloudflare security check. However, clicking this checkbox surreptitiously copies a malicious PowerShell command to the user’s clipboard, instructing them to open a command-line interface and paste the hidden script.

TerminalFix specifically directs victims to utilize Windows Terminal or PowerShell, rather than the simpler Windows Run box. This choice simplifies the execution of multi-line scripts, making the overall process smoother for the attacker while leveraging the user’s implicit trust in the familiar CAPTCHA interface. This tactic capitalizes on a growing trend where attackers bypass browser exploits by exploiting user trust in common verification prompts.

Upon execution, the copied command fetches a ZIP archive. This archive contains a legitimate, digitally signed program bundled with a malicious DLL. When the trusted application is launched from the attacker-controlled directory, Windows’ DLL search order prioritizes loading the adjacent malicious library first. This technique, known as DLL sideloading, allows the malicious code to run under the guise of a legitimate and less suspicious process, evading initial detection.

The malicious DLL then proceeds to download PNG images from attacker-controlled servers. Crucially, these images contain hidden program components embedded within their pixel data, a form of steganography. These components are extracted and further deployed. To ensure persistence, the malware establishes a Registry Run entry and schedules a task to restart its payload hourly, making it resilient to simple reboots or temporary shutdowns.

Stealthy Access Requires Faster Response

Once persistence is achieved, TerminalFix initiates a comprehensive reconnaissance phase within the compromised environment. Its scripts meticulously query domain trusts, identify domain administrator memberships, enumerate user and computer records, and discover server names. Targeted ping checks are also performed to map the network topology and identify valuable systems and domain-connected devices. This detailed mapping enables attackers to strategize their lateral movement and identify high-value targets.

The final payload includes its own Python runtime and launches a windowless interpreter, designed to operate discreetly in the background, minimizing its visibility to system administrators. This implant establishes an encrypted WebSocket connection over port 443, functioning as a SOCKS-style proxy. This sophisticated reverse tunnel allows the attackers to relay traffic to internal hosts through the victim’s machine, effectively bypassing perimeter defenses and creating a concealed network path. This method of reverse tunneling has been increasingly observed in recent enterprise backdoor campaigns, highlighting its effectiveness in maintaining covert access.

Defenders must recognize that a confirmed TerminalFix infection signifies potential network-level access, not merely an isolated malware incident. Incident response efforts should extend beyond simple malware cleanup to include thorough investigations into potential lateral movement and exposed credentials. Prioritizing password rotation for all accounts accessible from the affected system, especially privileged domain accounts, is critical.

Security teams should implement alerts for unexpected DLL loads, particularly when the sideloading host runs outside its normal Windows location. Monitoring outbound connections to known malicious infrastructure is also essential. For a detailed technical analysis and indicators of compromise, refer to the Microsoft’s analysis, which also provides indicators of compromise.

What You Should Do

• Educate Users: Emphasize that legitimate CAPTCHA challenges will never require users to open Terminal, PowerShell, or the Run dialog to paste commands.
• Restrict PowerShell: Implement restrictions on PowerShell usage for standard users. Where possible, enforce script-block logging, signed-script execution policies, or constrained-language mode. Configure Windows Terminal to warn users about pasting multi-line text.
• Monitor for Anomalies: Actively monitor for unexpected DLL loads, newly created scheduled tasks, hidden ProgramData folders, and Python processes launched with tunnel-related arguments.
• Network and Endpoint Protection: Block known malicious domains and URLs. Maintain robust web protection, and swiftly isolate any suspected devices to prevent lateral movement.
• Incident Response: Promptly investigate web logs for visits to compromised sites and inspect PowerShell activity, especially if triggered by clipboard operations. Preserve all logs for forensic analysis and assess the compromised machine’s network reach before restoring it to service.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.