ClickFix and TerminalFix Multi-Stage Attack Analysis

Recent threat intelligence highlights a significant evolution in the ClickFix family, specifically the TerminalFix variant, which has seen a 517% growth rate in 2025. Attributed to actors such as APT28 and MuddyWater, the campaign utilizes fake Cloudflare CAPTCHA overlays to trick users into executing malicious PowerShell commands. Unlike earlier versions, current iterations deploy a sophisticated multi-stage chain featuring DLL sideloading and steganographic payload extraction hidden within PNG images.

The technical threat involves the weaponization of legitimate Windows binaries like LockScreenContentServer.exe to load malicious DLLs (dui70.dll), leading to extensive Active Directory reconnaissance and the deployment of a custom Python-based reverse-tunnel implant. This implant establishes encrypted WebSocket channels, effectively turning compromised workstations into SOCKS-style proxies for lateral movement.

This activity represents a critical risk to enterprise environments due to its ability to bypass traditional sandboxes by turning the user into the execution layer. The transition from simple infostealers to full network-level persistent access indicates a shift toward high-impact hands-on-keyboard intrusions, including potential ransomware deployment.