TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence describes the TerminalFix campaign, a ClickFix variant that lures users with fake Cloudflare CAPTCHA overlays to paste a PowerShell command which installs a signed executable and malicious dui70.dll via DLL sideloading; the DLL retrieves steganographic payloads from PNG images, establishes registry and scheduled-task persistence, performs extensive Active Directory reconnaissance, and deploys a Python-based reverse WebSocket tunnel (gitnow.dev:443) providing SOCKS-style proxy access for attackers. The blog provides indicators of compromise, MITRE ATT&CK mappings, advanced hunting queries, and recommended detections and mitigations.