Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks

Hackers are using a fake Cloudflare CAPTCHA to turn a routine web check into a doorway into corporate networks.

The campaign, called TerminalFix, begins on compromised websites and persuades visitors to paste a supposed verification command into Windows Terminal or PowerShell.

It relies on a victim completing the attacker’s instructions. It has been seen against multiple industry sectors. The copied command fetches a ZIP archive, unpacks it under ProgramData, and starts a batch file in the background.

It launches a longer chain that hides code, maps the organisation, and creates a route back to attackers. Microsoft analysts identified TerminalFix as a more capable ClickFix variant, targeting organisations in several industries. 

Microsoft said in a report shared with Cyber Security News (CSN) the campaign combines social engineering, DLL sideloading, image-hidden data, and a custom reverse tunnel.

An infection can turn that computer into a pivot point for systems it can access internally, including critical internal systems. Researchers did not observe final hands-on actions, but the access could enable theft, security-control tampering, or ransomware.

Hackers Use Fake Cloudflare CAPTCHA

The lure looks familiar. A compromised page briefly loads normally before a counterfeit Cloudflare Turnstile screen appears, with a checkbox and loading animation.

Clicking it silently puts a harmful PowerShell command on the clipboard, then tells the visitor to open a command window and paste it.

TerminalFix directs users to Terminal or PowerShell instead of the Windows Run box, making longer multi-line scripts easier to execute.

Readers following recent fake CAPTCHA malware attacks will recognise the pattern: trust in a familiar verification prompt replaces the need for a browser exploit.

The archive contains a legitimate signed program and a malicious DLL. When the trusted application starts from the attacker-controlled folder, Windows loads the nearby library first. This lets malicious code run in a less suspicious process.

The DLL downloads PNG images from attacker-controlled sites and extracts hidden program components from their pixel data.

It also sets a Registry Run entry and a scheduled task that restarts the payload hourly. Similar misuse appears in PowerShell DLL sideloading attacks, showing why file location and process activity matter.

Stealthy Access Requires Faster Response

After persistence is established, TerminalFix maps the infected environment. Its scripts query domain trusts, domain administrator membership, user and computer records, and server names, then run targeted ping checks.

This reconnaissance helps attackers identify valuable systems and identify domain-connected devices. The final payload brings its own Python runtime and starts a windowless interpreter, keeping the process out of sight.

The implant opens an encrypted WebSocket connection over port 443 and works like a SOCKS-style proxy, allowing operators to relay traffic to internal hosts through the victim.

Reverse tunnelling has also featured in recent enterprise backdoor campaigns, creating a concealed network path. Defenders should treat a confirmed infection as potential network-level access, not simply a malware cleanup event.

Investigate lateral movement and exposed credentials, prioritise password rotation for accounts available on the affected system, especially privileged domain accounts.

Teams should alert when the sideloading host runs outside its normal Windows location and review outbound connections to listed infrastructure.

Prevention starts with teaching staff that a real CAPTCHA will not ask them to open Terminal, PowerShell, or Run and paste commands.

Organisations can restrict PowerShell for standard users, enable script-block logging, apply signed-script or constrained-language controls where practical, and configure Terminal warnings for multi-line pasted text.

The wider ClickFix phishing delivery trend makes layered controls important because victims initiate the first command.

Network and endpoint teams should monitor unexpected DLL loads, newly created scheduled tasks, hidden ProgramData folders, and Python processes launched with tunnel-related arguments.

Blocking the listed domains, maintaining web protection, and isolating suspected devices quickly can curb an attacker’s movement.

They should also check web logs for visits to compromised sites and inspect clipboard-triggered PowerShell activity, because prompt user action can otherwise resemble a legitimate administrative task.

Investigators should preserve logs and assess the machine’s network reach before returning it to normal service.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f	Initial ZIP archive, verify_pkg.zip
SHA-256	b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a	Custom reverse-tunnel implant, client.py
SHA-256	ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07	Malicious DLL, dui70.dll
SHA-256	026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab	Malicious DLL, dui70.dll
SHA-256	032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22	Malicious DLL, dui70.dll
SHA-256	df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf	Malicious DLL, dui70.dll
SHA-256	eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0	Malicious DLL, dui70.dll
SHA-256	5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8	Malicious DLL, dui70.dll
SHA-256	9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24	Malicious DLL, dui70.dll
SHA-256	342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e	Malicious DLL, dui70.dll
SHA-256	ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d	Malicious DLL, dui70.dll
Domain	gitnow[.]dev	Command-and-control server for the custom reverse tunnel on port 443
Domain	bestsocialmedianewspapper[.]com	Steganographic image hosting and payload delivery
Domain	offlineupdater[.]com	Steganographic image hosting failover
URL	hxxps://linked-log[.]com/	Compromised website used in the campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC