TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion
TerminalFix Campaign (TL-2026-2198), also tracked as TerminalFix, is a high-severity malware campaign, first published 2026-08-28. It has no confirmed attribution, affects Microsoft Windows (Windows Terminal / PowerShell social-engineering, maps to 15 MITRE ATT&CK techniques (T1018, T1027.003, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2198
- Threat ID
- TL-2026-2198
- Also known as
- TerminalFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-28
- Last reviewed
- 2026-08-28
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cross-sector
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in TerminalFix Campaign
Malware and tooling: ClickFix, TerminalFix, Nltest - S0359, Python 3.14.5 (embeddable, official python.org distribution), pythonw.exe
Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix-variant campaign that lures victims via fake Cloudflare Turnstile CAPTCHA overlays on compromised websites into pasting malicious PowerShell into Windows Terminal. The eight-stage chain sideloads a malicious dui70.dll alongside the legitimate LockScreenContentServer.exe, extracts an executable and DLL fragments hidden inside PNG images via steganography, performs extensive Active Directory reconnaissance, and deploys a custom Python reverse-tunnel implant (client.py) to a WebSocket C2 for network pivoting.
How TerminalFix Campaign works
TerminalFix is a variant of the ClickFix social-engineering technique documented by Microsoft Threat Intelligence on 2026-08-28. Where classic ClickFix lures direct victims to paste a command into the Windows Run dialog, TerminalFix instructs victims — via a fake Cloudflare Turnstile verification overlay injected into a compromised website (observed at linked-log.com) — to paste a multi-line command into Windows Terminal or PowerShell, increasing the odds that a complex payload executes successfully.
The pasted PowerShell prints spoofed Cloudflare verification output, downloads a ZIP archive (verify_pkg.zip, SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) to C:\ProgramData\f47f2a8c21c9df4e, and runs a dropped batch file (1.bat) that silently launches LockScreenContentServer.exe. That binary is a legitimately signed Windows executable with a static import dependency on dui70.dll; because the loader resolves the application directory before System32, dropping an attacker-controlled dui70.dll (unsigned, forged 2104 compile timestamp, masquerading as the genuine 'Windows DirectUI Engine') beside it achieves classic DLL side-loading (T1574.002) without any exploit or CVE. dui70.dll pulls an obfuscated payload from its own resource section and decodes it entirely in memory, never writing the decoded stage to disk.
The next stage retrieves a second-stage executable and a DLL split across three PNG images fetched via POST requests to bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover). A PowerShell function (Extract-RawFileFromImage) reads RGBA pixel channel bytes, treats the first 8 bytes as a 64-bit payload-length header, and reassembles the remaining bytes into the original file — one image yields the executable, two others carry DLL halves that are concatenated back together (T1027.003). The source images are deleted immediately after extraction to reduce forensic artifacts.
Persistence is established through an HKCU Run key using a randomized, service-like name (LockScreenContentServer_MuODG5yBM, T1547.001) and a scheduled task that re-launches LockScreenContentServer.exe every 60 minutes (T1053.005); the payload directory is hidden with attrib +h +s (T1564.001). The implant then performs broad Active Directory and host reconnaissance: systeminfo with multilingual (English/Spanish/German) findstr filters (T1082), nltest /domain_trusts and nltest /dclist: for trust enumeration (T1482), net group "domain admins" /domain and ADSI-based queries for domain admin and user/description harvesting (T1069.002, T1087.002), and an ADSI-plus-ping sweep that fingerprints domain controllers, database, backup, gateway, and mail servers by name (T1018).
A lightweight, network-free command loop watches a local text file and executes anything written to it via Invoke-Expression, giving the operator a primitive local C2 channel before the final stage: a custom Python reverse-tunnel client (client.py, SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a) run under the official embeddable Python 3.14.5 runtime via pythonw.exe for a hidden window. client.py upgrades a TLS connection to gitnow.dev:443 to a WebSocket at /tunnel (certificate verification disabled, CERT_NONE), rotates among four realistic browser User-Agent strings, and implements a 7-byte binary stream-multiplexing header supporting eight message types (identification, connection setup, data relay, keepalive, remote shutdown via MSG_SHUTDOWN/os._exit(), etc.). The tunnel provides SOCKS5-style arbitrary TCP proxying (T1572, T1071.001, T1105), letting the operator pivot from the compromised host to any internal system already fingerprinted during the AD reconnaissance phase — most notably domain controllers and other high-value infrastructure.
Microsoft assessed the campaign as active and ongoing across multiple industries at time of publication, released Microsoft Defender XDR detections (Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, Trojan:Python/Indigo.SA), and published Advanced Hunting KQL queries covering the ClickFix PowerShell execution pattern, the dui70.dll side-load, and the client.py tunnel launch and C2 connections. No CVE or exploited vulnerability underlies the chain — every stage relies on social engineering and living-off-the-land abuse of trusted Windows components.
MITRE ATT&CK techniques used in TL-2026-2198
Discovery
T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery
Defense Evasion
T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
Affected products and versions in TerminalFix Campaign
- Microsoft — Windows (Windows Terminal / PowerShell social-engineering vector; dui70.dll DLL search-order abuse via LockScreenContentServer.exe)
Vulnerable versions: All supported Windows versions relying on default DLL search order resolution and unrestricted PowerShell/Terminal command execution
Remediation for TerminalFix Campaign
Immediate actions
- Block or alert on connections to gitnow.dev, bestsocialmedianewspapper.com, and offlineupdater.com
- Hunt for LockScreenContentServer.exe executing outside its only legitimate path (C:\Windows\SystemApps) alongside a co-located dui70.dll
- Hunt for pythonw.exe/python.exe process command lines referencing client.py, --server, --uuid, cert.pem, or gitnow.dev
- Rotate credentials for any account active on an affected host, prioritizing domain admin accounts on domain-joined systems
- Review HKCU Run keys for LockScreenContentServer_* style names and scheduled tasks re-launching LockScreenContentServer.exe every 60 minutes
Workarounds
- Set PowerShell execution policy to AllSigned or RemoteSigned
- Restrict or audit use of the Windows Run dialog (Win+R) where not required
Longer-term hardening
- Restrict PowerShell execution via AppLocker or Windows Defender Application Control
- Enable PowerShell Script Block Logging and enforce Constrained Language Mode where possible
- Configure Windows Terminal Group Policy to warn users when pasted text contains multiple lines
- Deploy attack surface reduction rules blocking obfuscated scripts and unprevalent/untrusted executable launches
- Enable Microsoft Defender for Endpoint network protection and web protection, plus cloud-delivered protection in Defender Antivirus
- Train users to recognize fake CAPTCHA verification overlays that instruct pasting commands into Terminal or PowerShell
Weaknesses (CWE) in TerminalFix Campaign
CWE-427
Timeline of TerminalFix Campaign
- Microsoft releases Defender XDR detection signatures and Advanced Hunting KQL queries covering the full intrusion chain alongside the report.
- Analysis documents the client.py Python reverse-tunnel implant establishing a TLS WebSocket tunnel to gitnow.dev on port 443.
- Analysis documents second-stage payload extraction from PNG images hosted on bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover).
- Analysis documents dui70.dll side-loaded by the legitimate LockScreenContentServer.exe, with an unsigned malicious DLL carrying a forged 2104 compile timestamp.
- linked-log.com identified as a compromised website serving the fake Cloudflare Turnstile CAPTCHA overlay that initiates the lure.
- Report states TerminalFix is actively and continuously targeting organizations across multiple industries at time of publication.
- Microsoft Threat Intelligence publishes the TerminalFix campaign report describing an eight-stage ClickFix-variant intrusion chain.
Sources cited for TerminalFix Campaign
- TerminalFix campaign deploys reverse tunnel through multistage intrusion
- dui70.dll on HijackLibs
- MITRE ATT&CK T1574.002 - Hijack Execution Flow: DLL Side-Loading
- MITRE ATT&CK T1027.003 - Obfuscated Files or Information: Steganography
- MITRE ATT&CK T1572 - Protocol Tunneling
- MITRE ATT&CK T1189 - Drive-by Compromise
More in malware
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Detection coverage for TL-2026-2198
As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2198 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.