[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmTYIacahbdNmM8en6Anxsi0S_n2k0gvFLTMgfEz016k":3},{"article":4,"iocs":56,"watch_terms":79,"solutions":80,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"3339377d-839e-4ef6-9e3f-e6c053b45cba","TerminalFix campaign deploys a reverse tunnel through multistage intrusion","terminalfix-campaign-deploys-a-reverse-tunnel-through-multistage-intrusion-3a4096","Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance. The post TerminalFix campaign deploys a reverse tunnel through multistage intrusion appeared first on Microsoft Security Blog.","A new TerminalFix campaign, a variant of ClickFix, is targeting organizations by tricking users into executing malicious PowerShell commands via fake CAPTCHA prompts on compromised websites. This multi-stage attack chain employs DLL sideloading, steganography to hide payloads, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant for persistent network access.","TerminalFix campaign uses fake CAPTCHAs and DLL sideloading to deploy a reverse tunnel.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F28\u002Fterminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FMS_Actional-Insights_Rapid-response.jpg","2026-08-29T03:43:27+00:00","2026-08-29T06:01:29.665741+00:00",9,[17,20,22,25,28,31],{"name":18,"type":19},"TerminalFix","campaign",{"name":21,"type":19},"ClickFix",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"Cloudflare Turnstile CAPTCHA","product",{"name":29,"type":30},"Active Directory","technology",{"name":32,"type":30},"DLL sideloading","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,64,67,70,73,76],{"type":53,"value":58,"context":59},"dui70.dll","Malicious DLL used for sideloading.",{"type":61,"value":62,"context":63},"mitre_attack","T1574.002","DLL Side-Loading",{"type":61,"value":65,"context":66},"T1027","Obfuscated Files or Information (Steganography)",{"type":61,"value":68,"context":69},"T1071.004","Application Layer Protocol: DNS Tunneling (Implied by WebSocket C2)",{"type":61,"value":71,"context":72},"T1041","Exfiltration Over C2 Channel",{"type":61,"value":74,"context":75},"T1547.001","Registry Run Keys \u002F Startup Folder",{"type":61,"value":77,"context":78},"T1059.001","PowerShell",[23,26],{"controls":81,"vendors":165},[82,111,140],{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":112,"name":113,"problem":114,"products":115},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":141,"name":142,"problem":143,"products":144},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[145,152,159],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":141,"product_name":149,"url":150,"description":151},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":153,"product_name":156,"url":157,"description":158},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":160,"product_name":161,"url":163,"description":164},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[166],{"slug":167,"name":23,"logo_path":168,"roles":169},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[170],"reported_by",{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":192},"terminalfix-campaign-exploits-user-trust-to-deploy-persistent-reverse-tunnels","TerminalFix Campaign Exploits User Trust to Deploy Persistent Reverse Tunnels","The TerminalFix campaign succeeds primarily because users are socially engineered into manually executing malicious PowerShell commands disguised as routine CAPTCHA verification steps, bypassing many automated defenses. Once inside, attackers leverage DLL sideloading and steganography to evade detection while conducting deep Active Directory reconnaissance, dramatically expanding their foothold. A custom reverse-tunnel implant then establishes persistent, covert outbound connectivity that can survive perimeter firewall rules. This attack illustrates how chaining social engineering with advanced evasion techniques and living-off-the-land tools can compromise even reasonably hardened environments. Organizations that lack user training, robust PowerShell controls, and outbound traffic monitoring are especially vulnerable.",[176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191],"CIS Control 2 - Inventory and Control of Software Assets","CIS Control 4 - Secure Configuration of Enterprise Assets","CIS Control 8 - Audit Log Management","CIS Control 14 - Security Awareness and Skills Training","CIS Control 16 - Application Software Security","NIST SP 800-53 AC-6 - Least Privilege","NIST SP 800-53 SI-3 - Malicious Code Protection","NIST SP 800-53 AU-12 - Audit Record Generation","NIST SP 800-53 SC-7 - Boundary Protection","NIST CSF DE.CM-1 - Network Monitoring","NIST CSF PR.AT-1 - Security Awareness Training","MITRE ATT&CK T1059.001 - PowerShell","MITRE ATT&CK T1574.002 - DLL Side-Loading","MITRE ATT&CK T1001.002 - Steganography","MITRE ATT&CK T1572 - Protocol Tunneling","MITRE ATT&CK T1087 - Account Discovery (AD Recon)",{}]