Threat reportMalwareTL-2026-2198
TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion
Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix-variant campaign that lures victims via fake Cloudflare Turnstile CAPTCHA overlays on compromised websites into pasting malicious PowerShell into Windows Terminal. The eight-stage chain sideloads a malicious dui70.dll alongside the legitimate LockScreenContentServer.exe, extracts an executable and DLL fragments hidden inside PNG images via steganography, performs extensive Active Directory reconnaissance, and deploys a custom Python reverse-tunnel implant (client.py) to a WebSocket C2 for network pivoting.
Key facts for TerminalFix steganography campaign
| Identifiers | TL-2026-2198 |
|---|---|
| Also known as | TerminalFix |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows (Windows Terminal / PowerShell social-engineering vector; dui70.dll DLL search-order abuse via LockScreenContentServer.exe) |
| Weaknesses (CWE) | CWE-427 |
| Malware | ClickFix, TerminalFix |
| Tools | Nltest - S0359, Python 3.14.5 (embeddable, official python.org distribution), pythonw.exe |
| MITRE ATT&CK techniques | T1018 Remote System Discovery, T1027.003 Steganography, T1036.005 Match Legitimate Resource Name or Location, T1053.005 Scheduled Task, T1059.001 PowerShell, T1069.002 Domain Groups, T1071.001 Web Protocols, T1082 System Information Discovery, T1087.002 Domain Account, T1204.002 Malicious File, T1482 Domain Trust Discovery, T1547.001 Registry Run Keys / Startup Folder and 3 more in the attack flow |
| Motivation | UNKNOWN |
| Target sectors | cross-sector |
| Detection rules | 9 (1 shown free) |
| Sources | 6 cited sources |
Detection coverage for TerminalFix steganography campaign
As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2198 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation)
Detects the core TerminalFix post-exploitation chain: LockScreenContentServer.exe side-loading a malicious dui70.dll from outside its only legitimate path (C:\Windows\SystemApps), the randomized HKCU Run key (LockScreenContentServer_*) and hourly scheduled task that persist it, and the Active Directory reconnaissance (nltest, net group "domain admins", systeminfo) it performs after establishing itself.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1574.002, T1036.005, T1027.003, T1547.001, T1053.005, T1564.001, T1018, T1069.002, T1482, T1087.002, T1082
- Data sources: sysmon, windows_security, registry, scheduled_tasks
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=7 ImageLoaded="*\\dui70.dll" Image="*\\LockScreenContentServer.exe" NOT Image="C:\\Windows\\SystemApps\\*")
OR (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\LockScreenContentServer_*")
OR (EventCode=1 Image="*\\schtasks.exe" CommandLine="*LockScreenContentServer*")
OR (EventCode=1 (CommandLine="*nltest*domain_trusts*" OR CommandLine="*nltest*dclist*" OR CommandLine="*domain admins*" OR CommandLine="*systeminfo*"))
| eval technique=case(EventCode=7,"T1574.002,T1036.005", EventCode=13,"T1547.001", match(CommandLine,"schtasks"),"T1053.005", 1=1,"T1018,T1069.002,T1482,T1087.002,T1082")
| table _time, ComputerName, User, EventCode, Image, ImageLoaded, TargetObject, CommandLine, technique
| sort -_timeMicrosoft KQL
let sideload = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "dui70.dll"
| where InitiatingProcessFileName =~ "LockScreenContentServer.exe"
| where InitiatingProcessFolderPath !startswith @"C:\Windows\SystemApps"
| project Timestamp, DeviceName, AccountName, EventType="DLLSideLoad", Detail=InitiatingProcessFolderPath;
let persistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName startswith "LockScreenContentServer_"
| project Timestamp, DeviceName, AccountName, EventType="RunKeyPersistence", Detail=RegistryValueName;
let schedtask = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "LockScreenContentServer"
| project Timestamp, DeviceName, AccountName, EventType="ScheduledTaskPersistence", Detail=ProcessCommandLine;
let recon = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("nltest /domain_trusts", "nltest /dclist", "domain admins", "systeminfo")
| project Timestamp, DeviceName, AccountName, EventType="ADRecon", Detail=ProcessCommandLine;
sideload | union persistence | union schedtask | union recon
| sort by Timestamp descSigma
title: dui70.dll Side-Loaded by LockScreenContentServer.exe Outside SystemApps (TerminalFix)
id: 9c4e2b7a-1d3f-4a58-8e6c-5b7a9d0e2f31
status: experimental
description: Detects the legitimate LockScreenContentServer.exe loading dui70.dll from a path other than its only legitimate location (C:\Windows\SystemApps), indicating DLL side-loading used by the TerminalFix campaign to run an in-memory payload masquerading as the Windows DirectUI Engine, which then establishes Run-key/scheduled-task persistence and performs AD reconnaissance.
references:
- https://hijacklibs.net/entries/microsoft/built-in/dui70.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
- attack.defense-evasion
- attack.t1574.002
- attack.t1036.005
- attack.t1027.003
- attack.persistence
- attack.t1547.001
- attack.t1053.005
- attack.discovery
- attack.t1018
- attack.t1069.002
- attack.t1482
- attack.t1087.002
- attack.t1082
logsource:
category: image_load
product: windows
detection:
selection_image:
Image|endswith: '\\LockScreenContentServer.exe'
selection_dll:
ImageLoaded|endswith: '\\dui70.dll'
filter_legit:
Image|startswith: 'C:\\Windows\\SystemApps\\'
condition: selection_image and selection_dll and not filter_legit
falsepositives:
- None known; LockScreenContentServer.exe only legitimately runs from C:\Windows\SystemApps
level: criticalKnown false positives:
- None expected for the dui70.dll path check; if extended to registry-only monitoring, validate the value name still matches the LockScreenContentServer_* naming pattern
- AD reconnaissance commands (nltest, net group, systeminfo) may legitimately be run by IT/security staff during audits or Tier-0 assessments
Tuning notes: Pin the SystemApps exclusion path per OS build/install drive letter; narrow the recon window from 24h to 4h during active-incident triage, and correlate the four recon commands occurring within a single logon session to raise confidence before escalating.
- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) · unlock with TL Creds
- TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation) · unlock with TL Creds
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) · unlock with TL Creds
- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) · unlock with TL Creds
- TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation) · unlock with TL Creds
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) · unlock with TL Creds
- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) · unlock with TL Creds
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) · unlock with TL Creds
Indicators of compromise for TerminalFix steganography campaign
As of 2026-08-28, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2198.
Sample indicators (3 of 24)
- Domain:
gitnow[.]dev - File hash:
18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f - Domain:
bestsocialmedianewspapper[.]com
Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.
How TerminalFix steganography campaign works
TerminalFix is a variant of the ClickFix social-engineering technique documented by Microsoft Threat Intelligence on 2026-08-28. Where classic ClickFix lures direct victims to paste a command into the Windows Run dialog, TerminalFix instructs victims — via a fake Cloudflare Turnstile verification overlay injected into a compromised website (observed at linked-log.com) — to paste a multi-line command into Windows Terminal or PowerShell, increasing the odds that a complex payload executes successfully.
The pasted PowerShell prints spoofed Cloudflare verification output, downloads a ZIP archive (verify_pkg.zip, SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) to C:\ProgramData\f47f2a8c21c9df4e, and runs a dropped batch file (1.bat) that silently launches LockScreenContentServer.exe. That binary is a legitimately signed Windows executable with a static import dependency on dui70.dll; because the loader resolves the application directory before System32, dropping an attacker-controlled dui70.dll (unsigned, forged 2104 compile timestamp, masquerading as the genuine 'Windows DirectUI Engine') beside it achieves classic DLL side-loading (T1574.002) without any exploit or CVE. dui70.dll pulls an obfuscated payload from its own resource section and decodes it entirely in memory, never writing the decoded stage to disk.
The next stage retrieves a second-stage executable and a DLL split across three PNG images fetched via POST requests to bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover). A PowerShell function (Extract-RawFileFromImage) reads RGBA pixel channel bytes, treats the first 8 bytes as a 64-bit payload-length header, and reassembles the remaining bytes into the original file — one image yields the executable, two others carry DLL halves that are concatenated back together (T1027.003). The source images are deleted immediately after extraction to reduce forensic artifacts.
Persistence is established through an HKCU Run key using a randomized, service-like name (LockScreenContentServer_MuODG5yBM, T1547.001) and a scheduled task that re-launches LockScreenContentServer.exe every 60 minutes (T1053.005); the payload directory is hidden with attrib +h +s (T1564.001). The implant then performs broad Active Directory and host reconnaissance: systeminfo with multilingual (English/Spanish/German) findstr filters (T1082), nltest /domain_trusts and nltest /dclist: for trust enumeration (T1482), net group "domain admins" /domain and ADSI-based queries for domain admin and user/description harvesting (T1069.002, T1087.002), and an ADSI-plus-ping sweep that fingerprints domain controllers, database, backup, gateway, and mail servers by name (T1018).
A lightweight, network-free command loop watches a local text file and executes anything written to it via Invoke-Expression, giving the operator a primitive local C2 channel before the final stage: a custom Python reverse-tunnel client (client.py, SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a) run under the official embeddable Python 3.14.5 runtime via pythonw.exe for a hidden window. client.py upgrades a TLS connection to gitnow.dev:443 to a WebSocket at /tunnel (certificate verification disabled, CERT_NONE), rotates among four realistic browser User-Agent strings, and implements a 7-byte binary stream-multiplexing header supporting eight message types (identification, connection setup, data relay, keepalive, remote shutdown via MSG_SHUTDOWN/os._exit(), etc.). The tunnel provides SOCKS5-style arbitrary TCP proxying (T1572, T1071.001, T1105), letting the operator pivot from the compromised host to any internal system already fingerprinted during the AD reconnaissance phase — most notably domain controllers and other high-value infrastructure.
Microsoft assessed the campaign as active and ongoing across multiple industries at time of publication, released Microsoft Defender XDR detections (Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, Trojan:Python/Indigo.SA), and published Advanced Hunting KQL queries covering the ClickFix PowerShell execution pattern, the dui70.dll side-load, and the client.py tunnel launch and C2 connections. No CVE or exploited vulnerability underlies the chain — every stage relies on social engineering and living-off-the-land abuse of trusted Windows components.
MITRE ATT&CK techniques by tactic:
Discovery
T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery
Defense Evasion
T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
Remediation for TerminalFix steganography campaign
Immediate actions
- Block or alert on connections to gitnow.dev, bestsocialmedianewspapper.com, and offlineupdater.com
- Hunt for LockScreenContentServer.exe executing outside its only legitimate path (C:\Windows\SystemApps) alongside a co-located dui70.dll
- Hunt for pythonw.exe/python.exe process command lines referencing client.py, --server, --uuid, cert.pem, or gitnow.dev
- Rotate credentials for any account active on an affected host, prioritizing domain admin accounts on domain-joined systems
- Review HKCU Run keys for LockScreenContentServer_* style names and scheduled tasks re-launching LockScreenContentServer.exe every 60 minutes
Workarounds
- Set PowerShell execution policy to AllSigned or RemoteSigned
- Restrict or audit use of the Windows Run dialog (Win+R) where not required
Longer-term hardening
- Restrict PowerShell execution via AppLocker or Windows Defender Application Control
- Enable PowerShell Script Block Logging and enforce Constrained Language Mode where possible
- Configure Windows Terminal Group Policy to warn users when pasted text contains multiple lines
- Deploy attack surface reduction rules blocking obfuscated scripts and unprevalent/untrusted executable launches
- Enable Microsoft Defender for Endpoint network protection and web protection, plus cloud-delivered protection in Defender Antivirus
- Train users to recognize fake CAPTCHA verification overlays that instruct pasting commands into Terminal or PowerShell
Affected and fixed versions
- Microsoft — Windows (Windows Terminal / PowerShell social-engineering vector; dui70.dll DLL search-order abuse via LockScreenContentServer.exe)
Vulnerable versions: All supported Windows versions relying on default DLL search order resolution and unrestricted PowerShell/Terminal command execution
Timeline of TerminalFix steganography campaign
- Microsoft releases Defender XDR detection signatures and Advanced Hunting KQL queries covering the full intrusion chain alongside the report.
- Analysis documents the client.py Python reverse-tunnel implant establishing a TLS WebSocket tunnel to locked-ioc-22 on port 443.
- Analysis documents second-stage payload extraction from PNG images hosted on locked-ioc-15 (primary) and locked-ioc-18 (failover).
- Analysis documents dui70.dll side-loaded by the legitimate locked-ioc-17, with an unsigned malicious DLL carrying a forged 2104 compile timestamp.
- locked-ioc-19 identified as a compromised website serving the fake Cloudflare Turnstile CAPTCHA overlay that initiates the lure.
- Report states locked-ioc-21 is actively and continuously targeting organizations across multiple industries at time of publication.
- Microsoft Threat Intelligence publishes the locked-ioc-21 campaign report describing an eight-stage ClickFix-variant intrusion chain.
Sources cited for TerminalFix steganography campaign
- TerminalFix campaign deploys reverse tunnel through multistage intrusion Microsoft · Vendor report · 2026-08-28
- dui70.dll on HijackLibs hijacklibs.net · Research · 2026-08-29
- MITRE ATT&CK T1574.002 - Hijack Execution Flow: DLL Side-Loading MITRE · Research · 2026-08-29
- MITRE ATT&CK T1027.003 - Obfuscated Files or Information: Steganography MITRE · Research · 2026-08-29
- MITRE ATT&CK T1572 - Protocol Tunneling MITRE · Research · 2026-08-29
- MITRE ATT&CK T1189 - Drive-by Compromise MITRE · Research · 2026-08-29
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.
