TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion

TerminalFix Campaign (TL-2026-2198), also tracked as TerminalFix, is a high-severity malware campaign, first published 2026-08-28. It has no confirmed attribution, affects Microsoft Windows (Windows Terminal / PowerShell social-engineering, maps to 15 MITRE ATT&CK techniques (T1018, T1027.003, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2198

Threat ID
TL-2026-2198
Also known as
TerminalFix
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-28
Last reviewed
2026-08-28
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
cross-sector
Detection rules
9
Indicators of compromise
24

Malware and tooling in TerminalFix Campaign

Malware and tooling: ClickFix, TerminalFix, Nltest - S0359, Python 3.14.5 (embeddable, official python.org distribution), pythonw.exe

Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix-variant campaign that lures victims via fake Cloudflare Turnstile CAPTCHA overlays on compromised websites into pasting malicious PowerShell into Windows Terminal. The eight-stage chain sideloads a malicious dui70.dll alongside the legitimate LockScreenContentServer.exe, extracts an executable and DLL fragments hidden inside PNG images via steganography, performs extensive Active Directory reconnaissance, and deploys a custom Python reverse-tunnel implant (client.py) to a WebSocket C2 for network pivoting.

How TerminalFix Campaign works

TerminalFix is a variant of the ClickFix social-engineering technique documented by Microsoft Threat Intelligence on 2026-08-28. Where classic ClickFix lures direct victims to paste a command into the Windows Run dialog, TerminalFix instructs victims — via a fake Cloudflare Turnstile verification overlay injected into a compromised website (observed at linked-log.com) — to paste a multi-line command into Windows Terminal or PowerShell, increasing the odds that a complex payload executes successfully.

The pasted PowerShell prints spoofed Cloudflare verification output, downloads a ZIP archive (verify_pkg.zip, SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) to C:\ProgramData\f47f2a8c21c9df4e, and runs a dropped batch file (1.bat) that silently launches LockScreenContentServer.exe. That binary is a legitimately signed Windows executable with a static import dependency on dui70.dll; because the loader resolves the application directory before System32, dropping an attacker-controlled dui70.dll (unsigned, forged 2104 compile timestamp, masquerading as the genuine 'Windows DirectUI Engine') beside it achieves classic DLL side-loading (T1574.002) without any exploit or CVE. dui70.dll pulls an obfuscated payload from its own resource section and decodes it entirely in memory, never writing the decoded stage to disk.

The next stage retrieves a second-stage executable and a DLL split across three PNG images fetched via POST requests to bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover). A PowerShell function (Extract-RawFileFromImage) reads RGBA pixel channel bytes, treats the first 8 bytes as a 64-bit payload-length header, and reassembles the remaining bytes into the original file — one image yields the executable, two others carry DLL halves that are concatenated back together (T1027.003). The source images are deleted immediately after extraction to reduce forensic artifacts.

Persistence is established through an HKCU Run key using a randomized, service-like name (LockScreenContentServer_MuODG5yBM, T1547.001) and a scheduled task that re-launches LockScreenContentServer.exe every 60 minutes (T1053.005); the payload directory is hidden with attrib +h +s (T1564.001). The implant then performs broad Active Directory and host reconnaissance: systeminfo with multilingual (English/Spanish/German) findstr filters (T1082), nltest /domain_trusts and nltest /dclist: for trust enumeration (T1482), net group "domain admins" /domain and ADSI-based queries for domain admin and user/description harvesting (T1069.002, T1087.002), and an ADSI-plus-ping sweep that fingerprints domain controllers, database, backup, gateway, and mail servers by name (T1018).

A lightweight, network-free command loop watches a local text file and executes anything written to it via Invoke-Expression, giving the operator a primitive local C2 channel before the final stage: a custom Python reverse-tunnel client (client.py, SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a) run under the official embeddable Python 3.14.5 runtime via pythonw.exe for a hidden window. client.py upgrades a TLS connection to gitnow.dev:443 to a WebSocket at /tunnel (certificate verification disabled, CERT_NONE), rotates among four realistic browser User-Agent strings, and implements a 7-byte binary stream-multiplexing header supporting eight message types (identification, connection setup, data relay, keepalive, remote shutdown via MSG_SHUTDOWN/os._exit(), etc.). The tunnel provides SOCKS5-style arbitrary TCP proxying (T1572, T1071.001, T1105), letting the operator pivot from the compromised host to any internal system already fingerprinted during the AD reconnaissance phase — most notably domain controllers and other high-value infrastructure.

Microsoft assessed the campaign as active and ongoing across multiple industries at time of publication, released Microsoft Defender XDR detections (Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, Trojan:Python/Indigo.SA), and published Advanced Hunting KQL queries covering the ClickFix PowerShell execution pattern, the dui70.dll side-load, and the client.py tunnel launch and C2 connections. No CVE or exploited vulnerability underlies the chain — every stage relies on social engineering and living-off-the-land abuse of trusted Windows components.

MITRE ATT&CK techniques used in TL-2026-2198

Discovery

T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery

Defense Evasion

T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

Affected products and versions in TerminalFix Campaign

  • Microsoft — Windows (Windows Terminal / PowerShell social-engineering vector; dui70.dll DLL search-order abuse via LockScreenContentServer.exe)
    Vulnerable versions: All supported Windows versions relying on default DLL search order resolution and unrestricted PowerShell/Terminal command execution

Remediation for TerminalFix Campaign

Immediate actions

  • Block or alert on connections to gitnow.dev, bestsocialmedianewspapper.com, and offlineupdater.com
  • Hunt for LockScreenContentServer.exe executing outside its only legitimate path (C:\Windows\SystemApps) alongside a co-located dui70.dll
  • Hunt for pythonw.exe/python.exe process command lines referencing client.py, --server, --uuid, cert.pem, or gitnow.dev
  • Rotate credentials for any account active on an affected host, prioritizing domain admin accounts on domain-joined systems
  • Review HKCU Run keys for LockScreenContentServer_* style names and scheduled tasks re-launching LockScreenContentServer.exe every 60 minutes

Workarounds

  • Set PowerShell execution policy to AllSigned or RemoteSigned
  • Restrict or audit use of the Windows Run dialog (Win+R) where not required

Longer-term hardening

  • Restrict PowerShell execution via AppLocker or Windows Defender Application Control
  • Enable PowerShell Script Block Logging and enforce Constrained Language Mode where possible
  • Configure Windows Terminal Group Policy to warn users when pasted text contains multiple lines
  • Deploy attack surface reduction rules blocking obfuscated scripts and unprevalent/untrusted executable launches
  • Enable Microsoft Defender for Endpoint network protection and web protection, plus cloud-delivered protection in Defender Antivirus
  • Train users to recognize fake CAPTCHA verification overlays that instruct pasting commands into Terminal or PowerShell

Weaknesses (CWE) in TerminalFix Campaign

CWE-427

Timeline of TerminalFix Campaign

  • Microsoft releases Defender XDR detection signatures and Advanced Hunting KQL queries covering the full intrusion chain alongside the report.
  • Analysis documents the client.py Python reverse-tunnel implant establishing a TLS WebSocket tunnel to gitnow.dev on port 443.
  • Analysis documents second-stage payload extraction from PNG images hosted on bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover).
  • Analysis documents dui70.dll side-loaded by the legitimate LockScreenContentServer.exe, with an unsigned malicious DLL carrying a forged 2104 compile timestamp.
  • linked-log.com identified as a compromised website serving the fake Cloudflare Turnstile CAPTCHA overlay that initiates the lure.
  • Report states TerminalFix is actively and continuously targeting organizations across multiple industries at time of publication.
  • Microsoft Threat Intelligence publishes the TerminalFix campaign report describing an eight-stage ClickFix-variant intrusion chain.

Sources cited for TerminalFix Campaign

More in malware

Detection coverage for TL-2026-2198

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2198 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats