Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks

Hackers are using a fake Cloudflare CAPTCHA to turn a routine web check into a doorway into corporate networks.

The campaign, called TerminalFix, begins on compromised websites and persuades visitors to paste a supposed verification command into Windows Terminal or PowerShell.

It relies on a victim completing the attacker’s instructions. It has been seen against multiple industry sectors. The copied command fetches a ZIP archive, unpacks it under ProgramData, and starts a batch file in the background.

It launches a longer chain that hides code, maps the organisation, and creates a route back to attackers. Microsoft analysts identified TerminalFix as a more capable ClickFix variant, targeting organisations in several industries. 

Microsoft said in a report shared with Cyber Security News (CSN) the campaign combines social engineering, DLL sideloading, image-hidden data, and a custom reverse tunnel.

An infection can turn that computer into a pivot point for systems it can access internally, including critical internal systems. Researchers did not observe final hands-on actions, but the access could enable theft, security-control tampering, or ransomware.

Hackers Use Fake Cloudflare CAPTCHA

The lure looks familiar. A compromised page briefly loads normally before a counterfeit Cloudflare Turnstile screen appears, with a checkbox and loading animation.

Clicking it silently puts a harmful PowerShell command on the clipboard, then tells the visitor to open a command window and paste it.

TerminalFix directs users to Terminal or PowerShell instead of the Windows Run box, making longer multi-line scripts easier to execute.

Readers following recent fake CAPTCHA malware attacks will recognise the pattern: trust in a familiar verification prompt replaces the need for a browser exploit.

The archive contains a legitimate signed program and a malicious DLL. When the trusted application starts from the attacker-controlled folder, Windows loads the nearby library first. This lets malicious code run in a less suspicious process.

The DLL downloads PNG images from attacker-controlled sites and extracts hidden program components from their pixel data.

It also sets a Registry Run entry and a scheduled task that restarts the payload hourly. Similar misuse appears in PowerShell DLL sideloading attacks, showing why file location and process activity matter.

Stealthy Access Requires Faster Response

After persistence is established, TerminalFix maps the infected environment. Its scripts query domain trusts, domain administrator membership, user and computer records, and server names, then run targeted ping checks.

This reconnaissance helps attackers identify valuable systems and identify domain-connected devices. The final payload brings its own Python runtime and starts a windowless interpreter, keeping the process out of sight.

The implant opens an encrypted WebSocket connection over port 443 and works like a SOCKS-style proxy, allowing operators to relay traffic to internal hosts through the victim.

Reverse tunnelling has also featured in recent enterprise backdoor campaigns, creating a concealed network path. Defenders should treat a confirmed infection as potential network-level access, not simply a malware cleanup event.

Investigate lateral movement and exposed credentials, prioritise password rotation for accounts available on the affected system, especially privileged domain accounts.

Teams should alert when the sideloading host runs outside its normal Windows location and review outbound connections to listed infrastructure.

Prevention starts with teaching staff that a real CAPTCHA will not ask them to open Terminal, PowerShell, or Run and paste commands.

Organisations can restrict PowerShell for standard users, enable script-block logging, apply signed-script or constrained-language controls where practical, and configure Terminal warnings for multi-line pasted text.

The wider ClickFix phishing delivery trend makes layered controls important because victims initiate the first command.

Network and endpoint teams should monitor unexpected DLL loads, newly created scheduled tasks, hidden ProgramData folders, and Python processes launched with tunnel-related arguments.

Blocking the listed domains, maintaining web protection, and isolating suspected devices quickly can curb an attacker’s movement.

They should also check web logs for visits to compromised sites and inspect clipboard-triggered PowerShell activity, because prompt user action can otherwise resemble a legitimate administrative task.

Investigators should preserve logs and assess the machine’s network reach before returning it to normal service.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks appeared first on Cyber Security News.