# TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion

> Microsoft Threat Intelligence disclosed TerminalFix, a ClickFix-variant campaign that lures victims via fake Cloudflare Turnstile CAPTCHA overlays on compromised websites into pasting malicious PowerShell into Windows Terminal. The eight-stage chain sideloads a malicious dui70.dll alongside the legitimate LockScreenContentServer.exe, extracts an executable and DLL fragments hidden inside PNG images via steganography, performs extensive Active Directory reconnaissance, and deploys a custom Python reverse-tunnel implant (client.py) to a WebSocket C2 for network pivoting.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2198
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-terminalfix-steganography-campaign-tl-2026-2198.webp?v=13c5846b (Threadlinqs threat intel: TerminalFix Steganographic Reverse Tunnel: Detection & IOCs (TL-2026-2198) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2198
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

TerminalFix is a variant of the ClickFix social-engineering technique documented by Microsoft Threat Intelligence on 2026-08-28. Where classic ClickFix lures direct victims to paste a command into the Windows Run dialog, TerminalFix instructs victims — via a fake Cloudflare Turnstile verification overlay injected into a compromised website (observed at linked-log.com) — to paste a multi-line command into Windows Terminal or PowerShell, increasing the odds that a complex payload executes successfully.

The pasted PowerShell prints spoofed Cloudflare verification output, downloads a ZIP archive (verify_pkg.zip, SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) to C:\ProgramData\f47f2a8c21c9df4e, and runs a dropped batch file (1.bat) that silently launches LockScreenContentServer.exe. That binary is a legitimately signed Windows executable with a static import dependency on dui70.dll; because the loader resolves the application directory before System32, dropping an attacker-controlled dui70.dll (unsigned, forged 2104 compile timestamp, masquerading as the genuine 'Windows DirectUI Engine') beside it achieves classic DLL side-loading (T1574.002) without any exploit or CVE. dui70.dll pulls an obfuscated payload from its own resource section and decodes it entirely in memory, never writing the decoded stage to disk.

The next stage retrieves a second-stage executable and a DLL split across three PNG images fetched via POST requests to bestsocialmedianewspapper.com (primary) and offlineupdater.com (failover). A PowerShell function (Extract-RawFileFromImage) reads RGBA pixel channel bytes, treats the first 8 bytes as a 64-bit payload-length header, and reassembles the remaining bytes into the original file — one image yields the executable, two others carry DLL halves that are concatenated back together (T1027.003). The source images are deleted immediately after extraction to reduce forensic artifacts.

Persistence is established through an HKCU Run key using a randomized, service-like name (LockScreenContentServer_MuODG5yBM, T1547.001) and a scheduled task that re-launches LockScreenContentServer.exe every 60 minutes (T1053.005); the payload directory is hidden with attrib +h +s (T1564.001). The implant then performs broad Active Directory and host reconnaissance: systeminfo with multilingual (English/Spanish/German) findstr filters (T1082), nltest /domain_trusts and nltest /dclist: for trust enumeration (T1482), net group "domain admins" /domain and ADSI-based queries for domain admin and user/description harvesting (T1069.002, T1087.002), and an ADSI-plus-ping sweep that fingerprints domain controllers, database, backup, gateway, and mail servers by name (T1018).

A lightweight, network-free command loop watches a local text file and executes anything written to it via Invoke-Expression, giving the operator a primitive local C2 channel before the final stage: a custom Python reverse-tunnel client (client.py, SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a) run under the official embeddable Python 3.14.5 runtime via pythonw.exe for a hidden window. client.py upgrades a TLS connection to gitnow.dev:443 to a WebSocket at /tunnel (certificate verification disabled, CERT_NONE), rotates among four realistic browser User-Agent strings, and implements a 7-byte binary stream-multiplexing header supporting eight message types (identification, connection setup, data relay, keepalive, remote shutdown via MSG_SHUTDOWN/os._exit(), etc.). The tunnel provides SOCKS5-style arbitrary TCP proxying (T1572, T1071.001, T1105), letting the operator pivot from the compromised host to any internal system already fingerprinted during the AD reconnaissance phase — most notably domain controllers and other high-value infrastructure.

Microsoft assessed the campaign as active and ongoing across multiple industries at time of publication, released Microsoft Defender XDR detections (Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, Trojan:Python/Indigo.SA), and published Advanced Hunting KQL queries covering the ClickFix PowerShell execution pattern, the dui70.dll side-load, and the client.py tunnel launch and C2 connections. No CVE or exploited vulnerability underlies the chain — every stage relies on social engineering and living-off-the-land abuse of trusted Windows components.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1027.003 Steganography
- T1564.001 Hidden Files and Directories
- T1036.005 Match Legitimate Resource Name or Location
- T1018 Remote System Discovery
- T1069.002 Domain Groups
- T1482 Domain Trust Discovery
- T1087.002 Domain Account
- T1082 System Information Discovery
- T1572 Protocol Tunneling
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation)** (`TL-2026-2198-SPL-002`)

Detects the core TerminalFix post-exploitation chain: LockScreenContentServer.exe side-loading a malicious dui70.dll from outside its only legitimate path (C:\Windows\SystemApps), the randomized HKCU Run key (LockScreenContentServer_*) and hourly scheduled task that persist it, and the Active Directory reconnaissance (nltest, net group "domain admins", systeminfo) it performs after establishing itself.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.002, T1036.005, T1027.003, T1547.001, T1053.005, T1564.001, T1018, T1069.002, T1482, T1087.002, T1082
- **Data sources:** sysmon, windows_security, registry, scheduled_tasks
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=7 ImageLoaded="*\\dui70.dll" Image="*\\LockScreenContentServer.exe" NOT Image="C:\\Windows\\SystemApps\\*")
OR (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\LockScreenContentServer_*")
OR (EventCode=1 Image="*\\schtasks.exe" CommandLine="*LockScreenContentServer*")
OR (EventCode=1 (CommandLine="*nltest*domain_trusts*" OR CommandLine="*nltest*dclist*" OR CommandLine="*domain admins*" OR CommandLine="*systeminfo*"))
| eval technique=case(EventCode=7,"T1574.002,T1036.005", EventCode=13,"T1547.001", match(CommandLine,"schtasks"),"T1053.005", 1=1,"T1018,T1069.002,T1482,T1087.002,T1082")
| table _time, ComputerName, User, EventCode, Image, ImageLoaded, TargetObject, CommandLine, technique
| sort -_time
```

### Microsoft KQL

```kql
let sideload = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "dui70.dll"
| where InitiatingProcessFileName =~ "LockScreenContentServer.exe"
| where InitiatingProcessFolderPath !startswith @"C:\Windows\SystemApps"
| project Timestamp, DeviceName, AccountName, EventType="DLLSideLoad", Detail=InitiatingProcessFolderPath;
let persistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName startswith "LockScreenContentServer_"
| project Timestamp, DeviceName, AccountName, EventType="RunKeyPersistence", Detail=RegistryValueName;
let schedtask = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "LockScreenContentServer"
| project Timestamp, DeviceName, AccountName, EventType="ScheduledTaskPersistence", Detail=ProcessCommandLine;
let recon = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("nltest /domain_trusts", "nltest /dclist", "domain admins", "systeminfo")
| project Timestamp, DeviceName, AccountName, EventType="ADRecon", Detail=ProcessCommandLine;
sideload | union persistence | union schedtask | union recon
| sort by Timestamp desc
```

### Sigma

```yaml
title: dui70.dll Side-Loaded by LockScreenContentServer.exe Outside SystemApps (TerminalFix)
id: 9c4e2b7a-1d3f-4a58-8e6c-5b7a9d0e2f31
status: experimental
description: Detects the legitimate LockScreenContentServer.exe loading dui70.dll from a path other than its only legitimate location (C:\Windows\SystemApps), indicating DLL side-loading used by the TerminalFix campaign to run an in-memory payload masquerading as the Windows DirectUI Engine, which then establishes Run-key/scheduled-task persistence and performs AD reconnaissance.
references:
    - https://hijacklibs.net/entries/microsoft/built-in/dui70.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
    - attack.t1027.003
    - attack.persistence
    - attack.t1547.001
    - attack.t1053.005
    - attack.discovery
    - attack.t1018
    - attack.t1069.002
    - attack.t1482
    - attack.t1087.002
    - attack.t1082
logsource:
    category: image_load
    product: windows
detection:
    selection_image:
        Image|endswith: '\\LockScreenContentServer.exe'
    selection_dll:
        ImageLoaded|endswith: '\\dui70.dll'
    filter_legit:
        Image|startswith: 'C:\\Windows\\SystemApps\\'
    condition: selection_image and selection_dll and not filter_legit
falsepositives:
    - None known; LockScreenContentServer.exe only legitimately runs from C:\Windows\SystemApps
level: critical
```

**Known false positives:**

- None expected for the dui70.dll path check; if extended to registry-only monitoring, validate the value name still matches the LockScreenContentServer_* naming pattern
- AD reconnaissance commands (nltest, net group, systeminfo) may legitimately be run by IT/security staff during audits or Tier-0 assessments

**Tuning notes:** Pin the SystemApps exclusion path per OS build/install drive letter; narrow the recon window from 24h to 4h during active-incident triage, and correlate the four recon commands occurring within a single logon session to raise confidence before escalating.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) (locked: unlock with TL Creds)
- TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation) (locked: unlock with TL Creds)
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) (locked: unlock with TL Creds)
- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) (locked: unlock with TL Creds)
- TerminalFix dui70.dll Side-Load, Persistence & AD Reconnaissance (Post-Exploitation) (locked: unlock with TL Creds)
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) (locked: unlock with TL Creds)
- TerminalFix ClickFix Paste-and-Run — PowerShell via Windows Terminal (Exploitation) (locked: unlock with TL Creds)
- TerminalFix client.py Reverse Tunnel to [indicator] (C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- Domain: `gitnow[.]dev`
- File hash: `18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f`
- Domain: `bestsocialmedianewspapper[.]com`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [TerminalFix campaign deploys reverse tunnel through multistage intrusion](https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/)
- [dui70.dll on HijackLibs](https://hijacklibs.net/entries/microsoft/built-in/dui70.html)
- [MITRE ATT&CK T1574.002 - Hijack Execution Flow: DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1027.003 - Obfuscated Files or Information: Steganography](https://attack.mitre.org/techniques/T1027/003/)
- [MITRE ATT&CK T1572 - Protocol Tunneling](https://attack.mitre.org/techniques/T1572/)
- [MITRE ATT&CK T1189 - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2198