Affected Systems

Organizations across multiple sectors using Windows environments with PowerShell and Windows Terminal. Attack leverages compromised websites serving fake Cloudflare CAPTCHA pages to social engineer users into executing malicious PowerShell commands.

Exploitation Status

Active campaign observed in the wild. Microsoft has disclosed technical details of ongoing TerminalFix attacks targeting organizations. No CVE assigned as this is a social engineering campaign rather than a software vulnerability.

Business Impact

High-risk campaign providing attackers with persistent network-level proxy access through reverse-tunnel implant. Enables comprehensive Active Directory reconnaissance, privilege escalation paths, lateral movement, data exfiltration, and potential ransomware deployment. Attack chain uses DLL sideloading, steganographic payloads in PNG images, and establishes persistence via Registry Run keys and scheduled tasks. C2 infrastructure (gitnow[.]dev:443) tunnels arbitrary TCP traffic through encrypted WebSocket channels, allowing attackers to reach any host visible from victim's network.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Restrict PowerShell and Windows Run dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy
  • Enable PowerShell script block logging (Event ID 4104) and monitor for obfuscated or encoded commands, particularly multi-line scripts
  • Block or monitor access to known malicious domains: bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev
  • Monitor for DLL sideloading indicators, specifically LockScreenContentServer.exe loading suspicious dui70.dll files
  • Train users to recognize fake CAPTCHA prompts requesting PowerShell command execution and report suspicious website behavior
  • Audit scheduled tasks and Registry Run keys for unauthorized persistence mechanisms, particularly those executing Python scripts or PowerShell file-watch loops