Affected Systems
Organizations across multiple sectors using Windows systems with PowerShell and Windows Terminal. Attack leverages compromised websites serving fake Cloudflare CAPTCHA pages to trick users into executing malicious PowerShell commands.
Exploitation Status
Active campaign observed in the wild. Microsoft disclosed ongoing attacks targeting organizations across multiple sectors. No CVE assigned as this is a social engineering campaign rather than a software vulnerability.
Business Impact
High-risk social engineering campaign that establishes persistent network access through reverse-tunnel implant. Attackers gain ability to proxy arbitrary TCP traffic through compromised hosts, perform Active Directory reconnaissance (domain trusts, admin enumeration, user/computer searches), and reach internal systems. Creates pathway for privilege escalation, security control bypass, data exfiltration, and ransomware deployment. Particularly dangerous due to network-level proxy access enabling lateral movement.
Urgency
🟠Within 24 hours
Recommended Actions
- Restrict PowerShell and Windows Run dialog execution for standard users via AppLocker, Application Control for Windows, or Group Policy
- Enable PowerShell script block logging (Event ID 4104) and monitor for obfuscated or encoded commands, especially multi-line scripts
- Block or monitor access to known malicious domains: bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev
- Monitor for DLL sideloading indicators, specifically LockScreenContentServer.exe loading suspicious dui70.dll, and unusual persistence via Registry Run keys or scheduled tasks
- Train users to recognize fake CAPTCHA prompts that request copying and executing PowerShell commands, especially those claiming to be Cloudflare verification
- Monitor for unusual outbound WebSocket connections to port 443 and Python-based processes establishing reverse tunnels from workstations