Microsoft has published details about a Windows malware campaign it calls TerminalFix.
The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard.
Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command.
After gaining a foothold, the malware downloads what appear to be ordinary PNG images from attacker-controlled sites, but the images also contain concealed payload data. A PowerShell script reads the images’ pixel data: The first eight bytes specify the embedded file’s length, while the remaining data is reconstructed into an executable and two DLL fragments, which are joined on the victim’s disk.
The use of steganography is notable, but does not set TerminalFix apart from other ClickFix campaigns that have used the same method.
