Summary
Microsoft Threat Intelligence said TerminalFix tricks users into pasting a PowerShell command, then uses DLL sideloading, steganographic payloads, persistence and Active Directory reconnaissance. The chain ends with a Python-based encrypted WebSocket tunnel that can proxy arbitrary TCP traffic through the compromised host; Microsoft did not observe the later-stage actions in the analysed chain.
Why it matters
This raises the stakes of fake-CAPTCHA social engineering from commodity malware delivery to potential network pivoting, giving defenders concrete indicators and hunting guidance.
Related coverage
- New loss-of-control tracker records a sharp rise in AI incidents
- Texas pauses state funding for AI-powered Flock surveillance cameras