TAG

#clickfix

Stories connected through a shared idea, actor, technology or theme.

30 AugMicrosoft details TerminalFix campaign that turns fake CAPTCHA prompts into reverse tunnelsMicrosoft Threat Intelligence said TerminalFix tricks users into pasting a PowerShell command, then uses DLL sideloading, steganographic payloads, persistence and Active Directory reconnaissance. The chain ends with a Python-based encrypted WebSocket tunnel that can proxy arbitrary TCP traffic through the compromised host; Microsoft did not observe the later-stage actions in the analysed chain.→