TerminalFix is a newly documented ClickFix variant that Microsoft Threat Intelligence (researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan) disclosed on 2026-08-28. Unlike earlier ClickFix campaigns that lure victims to the Windows Run dialog to deploy a single infostealer, TerminalFix directs victims to Windows Terminal or PowerShell — improving reliability for longer, multi-line scripts — and delivers a far more elaborate, multi-stage intrusion chain.

Victims land on compromised websites displaying a fake Cloudflare Turnstile verification overlay. The "verification" instructs the user to paste and run a PowerShell command, which downloads a ZIP archive (SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) using a custom User-Agent header, extracts it to a hidden staging folder (C:\ProgramData\f47f2a8c21c9df4e, hidden via attrib +h +s), and launches a batch file (1.bat) that silently starts the legitimate signed binary LockScreenContentServer.exe while the terminal prints fake Cloudflare verification text to keep the user occupied.

LockScreenContentServer.exe has a static import dependency on the real Windows DirectUI Engine DLL, dui70.dll. Because the Windows loader searches the application directory before System32, dropping a malicious dui70.dll (observed in at least nine SHA-256 variants) alongside the legitimate EXE causes the trusted binary to load and execute attacker code — classic DLL side-loading (T1574.002). The sideloaded DLL then retrieves further payloads hidden inside PNG images via a custom PowerShell function (Extract-RawFileFromImage) that reads the RGBA pixel channels: the first 8 bytes encode a 64-bit payload length, the remainder is the embedded file. Three images are fetched via POST requests from bestsocialmedianewspapper[.]com (primary) or offlineupdater[.]com (failover), with the DLL payload split across two images to hinder static analysis; source images are deleted after extraction to reduce forensic residue.

Persistence is established two ways: a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\LockScreenContentServer_MuODG5yBM) and a scheduled task of the same name that re-executes LockScreenContentServer.exe every 60 minutes.

The implant then performs extensive Active Directory reconnaissance: domain trust discovery (nltest /domain_trusts, nltest /dclist:), domain admin group enumeration (net group "domain admins" /domain), AD user/computer searches via ADSI with description-field harvesting, systeminfo collection with multilingual (English/Spanish/German) findstr filters, and ping sweeps of discovered infrastructure roles (domain controllers, database servers, backup systems, gateways, mail systems). A persistent PowerShell file-watch loop also monitors a text file for attacker commands, executes them via Invoke-Expression, and writes results to an output file — a rudimentary asynchronous, filesystem-based C2 channel that runs in parallel with the primary implant.

The final stage deploys client.py (SHA-256 b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a), a custom reverse-tunnel implant run under an unmodified, official python.org Python 3.14.5 distribution via pythonw.exe (no visible window) to avoid raising suspicion. The implant connects outbound over TLS on port 443 to gitnow[.]dev, upgrades to a WebSocket at the /tunnel endpoint, disables certificate verification (CERT_NONE), and rotates among four realistic browser User-Agent strings. A 7-byte custom binary header (message type + stream ID + length) multiplexes multiple tunneled streams, with SOCKS5-style address parsing supporting IPv4, IPv6, and hostname targets — giving the operator arbitrary TCP proxy access to any host reachable from the compromised endpoint. Message types cover implant identification, connection setup, data relay, keepalive, and remote termination (MSG_SHUTDOWN, which calls os._exit() to bypass normal Python cleanup).

Microsoft did not attribute the campaign to a named actor or group and did not specify targeted sectors or regions beyond "organizations across multiple industries." Microsoft assesses that the reverse-tunnel access this campaign establishes could subsequently be leveraged for privilege escalation, security-control tampering, data exfiltration, and ransomware deployment across enterprise networks, though no such follow-on activity has been confirmed in the public reporting. Microsoft Defender Antivirus detects components under Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, and Trojan:Python/Indigo.SA, and Microsoft published Defender XDR/Sentinel KQL hunting queries for the ClickFix PowerShell launch, the DLL sideload, the client.py execution, and network connections to the campaign's domains.