The record
Written from the 1 report below. Nothing here is unsourced.
- Microsoft has warned about a new attack campaign called TerminalFix that tricks users into running a malicious command in Windows Terminal or PowerShell.
- The attackers use compromised websites to show fake Cloudflare CAPTCHA pages that prompt visitors to copy and execute a malicious PowerShell command.
- The malware installs a reverse-tunnel backdoor that gives attackers persistent network-level access through the infected machine, along with tools to map an organization's internal Active Directory network.
- Microsoft says this kind of access can let attackers steal sensitive data, disable security controls, and deploy ransomware inside enterprise networks.
- Microsoft advises organizations to restrict PowerShell execution for standard users, monitor for DLL sideloading, and train employees to recognize ClickFix-style attacks.
What to watch next
- Whether TerminalFix spreads beyond the currently targeted sectors or geographies
- Microsoft or security firms publishing indicators of compromise, such as the attacker domains 'bestsocialmedianewspapper[.]com' and 'gitnow[.]dev'
- Organizations adopting the recommended mitigations like AppLocker restrictions and PowerShell script block logging
Who said what1
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Microsoft
Windows maker
1 quote · 1 outlet
“This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel”
In the article
…map the internal network topology The attack also delivers a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. " This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization's internal network through the reverse tunnel ," Microsoft said. "The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host." The tech giant has warned that such access can be…
Coverage1
All filed from India
Named India · Cloudflare · Windows · Microsoft · Parasharan Raghavan · Sagar Patil · Suriyaraj Natarajan
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.