Executive Summary

The Cyber Threat Intelligence (CTI) Unit of BGD e-GOV CIRT is issuing this advisory regarding the recently observed TerminalFix campaign, a sophisticated evolution of the ClickFix social-engineering technique.

The campaign begins with a compromised website displaying a fraudulent Cloudflare CAPTCHA/Turnstile verification interface. Instead of performing a genuine CAPTCHA verification, the victim is instructed to copy and paste a command into Windows Terminal or PowerShell. Once executed, the command initiates a multistage intrusion involving PowerShell, DLL side-loading, steganographically concealed payloads, persistence mechanisms, Active Directory reconnaissance and ultimately a custom reverse WebSocket tunnel.

The most significant aspect of this campaign is not simply malware execution on the endpoint. The final reverse-tunneling component can transform the compromised Windows workstation into a network pivot, allowing an operator to establish TCP connections to systems reachable from that workstation. Microsoft reports that the tunnel uses TLS/WebSocket communication over TCP/443 and supports arbitrary TCP proxying through a SOCKS5-style address mechanism.

For organizations in Bangladesh, this presents a significant risk where employees use domain-joined Windows workstations to access:

· Active Directory;

· File servers;

· Database servers;

· Administrative systems;

· VPN infrastructure;

· Internal web applications;

· Government information systems;

· Critical-infrastructure management networks.

However, the techniques are directly applicable to Windows enterprise environments commonly deployed in Bangladesh and should therefore be treated as an immediate defensive-hunting priority.

Threat Overview

TerminalFix represents an evolution of the ClickFix attack technique.

Traditional ClickFix campaigns commonly manipulate users into executing commands through Windows Run or other trusted interfaces. TerminalFix adapts this technique to Windows Terminal/PowerShell, making it more suitable for executing longer and more complex command sequences. 

Bangladesh-Specific Risk Assessment

The campaign is particularly relevant to Bangladesh because many organizations operate Windows-based enterprise environments containing centralized Active Directory infrastructure.

A compromised employee workstation may have network visibility to:

User Workstation

· Domain Controller

· File Server

· Database Server

· Internal Web Applications

· Management Systems

· Backup Infrastructure

· Administrative Services

If the attacker establishes a reverse tunnel on such a workstation, the external operator may not need direct Internet access to these internal systems. Instead:

Attacker

   │

   │ TLS/WebSocket :443

  ▼

Possible Compromised Endpoint

  │

 ├────────► Internal Server

 ├────────► Domain Controller

 ├────────► Database

 ├────────► File Share

   └────────► Other Reachable Hosts

This effectively turns the infected workstation into a proxy/pivot point inside the organization's trusted network. Microsoft specifically describes this capability as enabling the attacker to reach hosts visible from the compromised system.