{
  "id": 4750750,
  "title": "TerminalFix: Fake CAPTCHA to PNG Steganography and WebSocket Reverse Tunnels",
  "url": "https://urgent.news/2026/09/01/terminalfix-fake-captcha-to-png-steganography-and-websocket-reverse",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T00:36:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/terminalfix-fake-captcha-to-png-steganography-and-websocket-reverse-tunnels-1p29"
  },
  "original_language": "en",
  "account": "Microsoft has warned of new attacks called TerminalFix that use fake CAPTCHAs to gain access to Windows systems. These attacks involve tricking users into pasting malicious PowerShell commands into their terminals. Once executed, the fake CAPTCHA displays a fake Cloudflare Turnstile page and copies a PowerShell script to the clipboard. When the user pastes the script into the terminal, it extracts a ZIP file to the C:\\ProgramData folder and runs a batch file called 1.bat.\n\nThe attack is set up to side-load a malicious DLL called dui70.dll from the legitimate LockScreenContentServer.exe process. The PowerShell script then restores the executable and DLL fragments from three PNG images. This creates a Run key and a 60-minute scheduled task, then hides the folder containing the malicious files. The attack then enumerates Active Directory and internal servers to set up a reverse WebSocket tunnel that allows external attackers to communicate with internal network resources.\n\nThe fake CAPTCHA display and the malicious PowerShell clipboard copy are the only observable indicators of the attack. The primary entry point for the attackers is compromised websites, which are visited by the user. Once the attack is successful, the compromised endpoint becomes a pivot point for the attackers to move laterally within the internal network, potentially leading to credential theft, lateral movement, and data exfiltration.\n\nTo defend against TerminalFix attacks, users should be cautious when presented with fake CAPTCHAs that ask them to paste PowerShell commands into the terminal. Administrators should monitor for suspicious activity such as random-name folders in C:\\ProgramData, LockScreenContentServer.exe running from non-standard paths, dui70.dll, PNG file uploads, Run keys, scheduled tasks, and pythonw.exe running client.py. Network monitoring should also be focused on TLS WebSocket traffic to gitnow.dev:443, which indicates pivot behavior.",
  "summary": "1. Basic Information Article Title : Microsoft warns of TerminalFix attacks deploying reverse tunnels Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Source : Microsoft Security Research Related Malware / Threat Groups / CVEs / Products : TerminalFix, client.py reverse tunnel, Windows Terminal, PowerShell, LockScreenContentServer.exe, Active…",
  "key_points": [
    "Fake CAPTCHA used to trick users into pasting malicious PowerShell commands",
    "PowerShell script extracts ZIP file to C:\\ProgramData and runs batch file",
    "Reverse WebSocket tunnel established for external attackers to communicate"
  ],
  "editors_take": "This development signals a sophisticated threat where attackers use social engineering and steganography to bypass security measures and gain lateral movement within internal networks, potentially leading to credential theft and data exfiltration.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}