TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion — Threadlinqs Intelligence
As of 2026-08-28, TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-2198 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix-variant campaign that lures victims via fake Cloudflare Turnstile CAPTCHA overlays on compromised websites into pasting malicious
TerminalFix is a variant of the ClickFix social-engineering technique documented by Microsoft Threat Intelligence on 2026-08-28. Where classic ClickFix lures direct victims to paste a command into the Windows Run dialog, TerminalFix instructs victims — via a fake Cloudflare Turnstile verification overlay injected into a compromised website (observed at linked-log.com) — to paste a multi-line command into Windows Terminal or PowerShell, increasing the odds that a complex payload executes successfully.
The pasted PowerShell prints spoofed Cloudflare verification output, downloads a ZIP archive (verify_pkg.zip, SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) to C:\ProgramData\f47f2a8c21c9df4e, and runs a dropped batch file (1.bat) that silently launches LockScreenContentServer.exe. That binary is a legitimately signed Windows executable with a static import dependency on dui70.dll; because the loader resolves the application directory before System32, dropping an attacker-controlled dui70.dll (unsigned, forged 2104 compile timestamp, masquerading as the genuine 'Windows DirectUI Engine') beside it achieves classic DLL side-loading (T1574.002) without any exploit or CVE. dui70.dll pulls an obfuscated payload from its own resource section and decodes it entirely in memory, never writing the decoded stage to disk.
The next stage retrieves a second-stage executable and a DLL split across three PNG images fetched via POST requests to bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover). A PowerShell function (Extract-RawFileFromImage) reads RGBA pixel channel bytes, treats the first 8 bytes as a 64-bit payload-length header, and reassembles the remaining bytes into the original file — one image yields the executable, two others carry DLL halves that are concatenated back together (T1027.003). The source images are deleted immediately after extraction to reduce forensic artifacts.
Persistence is established through an HKCU Run key using a randomized, service-like name (LockScreenContentServer_MuODG5yBM, T1547.001) and a scheduled task that re-launches LockScreenContentServer.exe every 60 minutes (T1053.005); the payload directory is hidden with attrib +h +s (T1564.001). The implant then performs broad Active Directory and host reconnaissance: systeminfo with multilingual (English/Spanish/German) findstr filters (T1082), nltest /domain_trusts and nltest /dclist: for trust enumeration (T1482), net group "domain admins" /domain and ADSI-based queries for domain admin and user/description harvesting (T1069.002, T1087.002), and an ADSI-plus-ping sweep that fingerprints domain controllers, database, backup, gateway, and mail servers by name (T1018).
A lightweight, network-free command loop watches a local text file and executes anything written to it via Invoke-Expression, giving the operator a primitive local C2 channel before the final stage: a custom Python reverse-tunnel client (client.py, SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a) run under the official embeddable Python 3.14.5 runtime via pythonw.exe for a hidden window. client.py upgrades a TLS connection to gitnow.dev:443 to a WebSocket at /tunnel (certificate verification disabled, CERT_NONE), rotates among four realistic browser User-Agent strings, and implements a 7-byte binary stream-multiplexing header supporting eight message types (identification, connection setup, data relay, keepalive, remote shutdown via MSG_SHUTDOWN/os._exit(), etc.). The tunnel provides SOCKS5-style arbitrary TCP proxying (T1572, T1071.001, T1105), letting the operator pivot from the compromised host to any internal system already fingerprinted during the AD reconnaissance phase — most notably domain controllers and other high-value infrastructure.
Microsoft assessed the campaign as active and ongoing across multiple industries at time of publication, released Microsoft Defender XDR detections (Trojan:Win32/ClickFix.*, Troj
Target sectors: cross-sector
Timeline
- Microsoft Threat Intelligence publishes the TerminalFix campaign report describing an eight-stage ClickFix-variant intrusion chain.
- Report states TerminalFix is actively and continuously targeting organizations across multiple industries at time of publication.
- linked-log.com identified as a compromised website serving the fake Cloudflare Turnstile CAPTCHA overlay that initiates the lure.
- Analysis documents dui70.dll side-loaded by the legitimate LockScreenContentServer.exe, with an unsigned malicious DLL carrying a forged 2104 compile timestamp.
- Analysis documents second-stage payload extraction from PNG images hosted on bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover).
- Analysis documents the client.py Python reverse-tunnel implant establishing a TLS WebSocket tunnel to gitnow.dev on port 443.
- Microsoft releases Defender XDR detection signatures and Advanced Hunting KQL queries covering the full intrusion chain alongside the report.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.001, T1204.002, T1547.001, T1053.005, T1574.001, T1027.003, T1564.001, T1036.005, T1018, T1069.002
