Fast Facts
- A new ClickFix-style campaign tricks users into executing malicious PowerShell commands by disguising them as troubleshooting or verification steps, often via social engineering tactics like fake Zoom support calls.
- The attack chain begins with a single malicious PowerShell command that downloads a ZIP file containing a DLL, initiating a complex series of activities including steganography, persistence, and establishing encrypted WebSocket tunnels for internal network access.
- These tunnels give threat actors persistent and stealthy access to compromised networks, enabling privilege escalation, data exfiltration, and ransomware deployment, making the campaign particularly dangerous for enterprises.
- Defenses should focus on restricting script execution policies, educating users about social engineering attacks, and monitoring for suspicious command activity—since overly broad restrictions are often impractical.
PowerShell Malicious Campaign Uses Social Tricks
A new campaign named “TerminalFix” targets organizations by urging users to run PowerShell commands. This trick is similar to earlier tactics called ClickFix, where attackers trick users into executing harmful code. Victims often visit fake or compromised websites that prompt them to paste commands into their computers. These commands connect to attacker-controlled servers and download malicious files. The attackers then use these files to gain access and control over enterprise networks. Because PowerShell can run complex scripts, attackers can perform many steps after initial access. This makes the campaign particularly dangerous for large companies across various industries.
Attackers Build a Complex Chain of Actions
The campaign starts with a single PowerShell command that downloads a ZIP file containing a malicious DLL. This DLL begins a series of actions designed to stay hidden. For instance, it hides itself in images and uses registry keys and scheduled tasks to remain active. The attackers also scan the internal network to understand it better. Eventually, they deploy a Python-based tool that creates a secure tunnel back to their servers. This tunnel allows hackers to control the network directly. As a result, they can steal sensitive data, disable safety features, or even install ransomware. Because of these stealth techniques and persistent access, this campaign poses a serious threat, especially to larger organizations. Experts recommend restricting PowerShell and user access to prevent such attacks and educate employees on recognizing social engineering tactics.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Explore past and present digital transformations on the Internet Archive.
CyberRisk-V1
