TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL Sideloading, and PNG Steganography

TerminalFix Campaign Deploys Custom Python Reverse-Tunnel (TL-2026-2260) is a high-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Microsoft Windows (client and server), maps to 15 MITRE ATT&CK techniques (T1018, T1027.003, T1036.005), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-2260

Threat ID
TL-2026-2260
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-31
Last reviewed
2026-08-31
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
multiple industries
Detection rules
9
Indicators of compromise
19

Malware and tooling in TerminalFix Campaign Deploys Custom Python Reverse-Tunnel

Malware and tooling: TerminalFix (ClickFix variant), client.py (TerminalFix reverse-tunnel implant), Custom TLS/WebSocket reverse-tunnel proxy (7-byte binary frame header, SOCKS5-style addressing), Embeddable Python 3.14.5 runtime (python.org distribution)

Microsoft Threat Intelligence documented TerminalFix, a ClickFix variant that lures users on compromised websites into pasting and executing malicious PowerShell into Windows Terminal (rather than the Run dialog) to reliably run complex multi-stage scripts. The chain uses DLL sideloading and steganographic PNG payload extraction to deploy client.py, a custom Python-based reverse-tunnel implant that proxies arbitrary TCP traffic over an encrypted WebSocket channel to gitnow[.]dev:443, followed by extensive Active Directory reconnaissance. Microsoft states it did not observe follow-on hands-on-keyboard actions (privilege escalation, security-control tampering, data exfiltration, ransomware) in the analyzed intrusion chain — the network-level access the tunnel grants creates the conditions for those outcomes, but they are an assessed risk, not a confirmed observed one.

How TerminalFix Campaign Deploys Custom Python Reverse-Tunnel works

TerminalFix is a variant of the ClickFix social-engineering technique that Microsoft Threat Intelligence disclosed in a rapid-response research article on 2026-08-28. Victims land on a compromised website (observed example: linked-log[.]com) that overlays a spoofed Cloudflare Turnstile CAPTCHA verification page. Rather than directing the user to the Windows Run dialog — the classic ClickFix pattern — TerminalFix instructs the victim to paste and execute a PowerShell command inside Windows Terminal or a PowerShell console, which reliably supports longer, more complex multi-line scripts than the Run dialog's single-line input.

The pasted PowerShell downloads a ZIP archive (verify_pkg.zip) from attacker infrastructure into a concealed, hidden-and-system-flagged staging directory under C:\ProgramData (observed path fragment: f47f2a8c21c9df4e), then silently launches a batch file (1.bat). The batch file executes a legitimate, Microsoft-signed binary, LockScreenContentServer.exe, which is abused via classic DLL search-order sideloading to load a co-located malicious library, dui70.dll — an unsigned file masquerading as the Windows DirectUI Engine component, observed in at least eight hash variants and carrying a forged 2104 PE timestamp.

The malware then reaches out to bestsocialmedianewspapper[.]com and a failover host, offlineupdater[.]com, to download PNG images that conceal executables and DLL fragments steganographically embedded in pixel/RGBA channel data behind an 8-byte length prefix; these are reassembled on disk without ever touching the network as a directly-flagged binary. Persistence is established via Registry Run keys and a scheduled task that re-triggers roughly every 60 minutes.

The malware then stages an embeddable Python 3.14.5 runtime (the official python.org distribution) and launches client.py via the windowless pythonw.exe. client.py opens a reverse WebSocket tunnel over TLS 1.2 (certificate validation disabled, CERT_NONE) to gitnow[.]dev on port 443, using a custom 7-byte binary frame header (type + stream ID + length) to multiplex a SOCKS5-style TCP proxy — giving the operator direct network-level reach to any host visible from the compromised endpoint, plus a remote MSG_SHUTDOWN control message. Before or alongside tunnel setup, the implant performs extensive on-host and Active Directory reconnaissance: domain trust enumeration (nltest /domain_trusts, /dclist:), domain admin group membership (net group "domain admins" /domain), ADSI-based user/description harvesting, computer enumeration with targeted ping sweeps, and systeminfo collection localized in English, Spanish, and German — suggesting the toolkit is built for reuse against a non-English-speaking victim base.

Microsoft is explicit that it did not observe further hands-on-keyboard activity in the chains it analyzed: no privilege-escalation exploitation, no security-control tampering, no data exfiltration, and no ransomware deployment were confirmed. The company frames the SOCKS-style network pivot as creating the conditions under which an operator with interactive tunnel access could pursue those outcomes, not as something documented in this campaign to date. No CVE is associated with the intrusion chain (it depends on social engineering and living-off-the-land execution, not a software vulnerability), no specific victim sector or region is disclosed beyond "multiple industries," and no threat actor group has been attributed.

MITRE ATT&CK techniques used in TL-2026-2260

Discovery

T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery

Defense Evasion

T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

Affected products and versions in TerminalFix Campaign Deploys Custom Python Reverse-Tunnel

  • Microsoft — Windows (client and server)
    Vulnerable versions: All supported Windows versions capable of running Windows Terminal/PowerShell and the signed LockScreenContentServer.exe component

Remediation for TerminalFix Campaign Deploys Custom Python Reverse-Tunnel

Immediate actions

  • Block network egress to gitnow[.]dev, bestsocialmedianewspapper[.]com, and offlineupdater[.]com at DNS/proxy/firewall.
  • Alert on and quarantine LockScreenContentServer.exe running from any directory outside its legitimate Windows system path, or co-located with a dui70.dll.
  • Hunt for pythonw.exe processes making outbound TLS connections on port 443 to non-standard/newly-registered domains, especially spawned from a hidden ProgramData subdirectory.
  • Search endpoint and proxy logs for embeddable Python 3.14.5 runtime artifacts and for verify_pkg.zip / 1.bat / cert.pem filenames.
  • Review clipboard-to-Windows-Terminal and clipboard-to-PowerShell execution telemetry for commands pasted immediately after a browser CAPTCHA/verification prompt.

Workarounds

  • Enforce browser/OS-level warnings or blocks on clipboard-to-terminal paste actions triggered from web content where feasible.
  • Restrict local execution of unsigned DLLs alongside signed binaries via WDAC/AppLocker rules targeting the observed sideloading pattern.

Longer-term hardening

  • Deploy EDR rules that flag DLL sideloading into signed Microsoft binaries executing from user-writable or ProgramData staging paths.
  • Enable PowerShell Script Block Logging and Windows Terminal command-line auditing enterprise-wide to catch ClickFix-style paste-and-run activity.
  • Restrict outbound WebSocket/arbitrary-TLS connections from workstations to an allowlist of expected destinations; alert on protocol tunneling indicators (long-lived, high-volume single-destination TLS sessions from non-server hosts).
  • Deploy user-awareness training specifically covering fake CAPTCHA / 'verify you are human' prompts that instruct pasting commands into Run, Terminal, or PowerShell.
  • Monitor for the specific Active Directory reconnaissance command patterns (nltest /domain_trusts, net group "domain admins" /domain) as a detection baseline even absent a confirmed TerminalFix hash match.

Timeline of TerminalFix Campaign Deploys Custom Python Reverse-Tunnel

  • Microsoft states it did not observe further hands-on-keyboard actions (privilege escalation, security-control tampering, exfiltration, ransomware) in the chains it analyzed.
  • An embedded Python 3.14.5 runtime launches client.py via pythonw.exe, opening a TLS WebSocket reverse tunnel to gitnow[.]dev:443 for SOCKS-style TCP proxying.
  • The implant runs domain trust, domain admin, ADSI user/computer, and multilingual systeminfo reconnaissance commands against the victim's Active Directory environment.
  • Registry Run key and an approximately 60-minute-interval scheduled task are created to maintain persistence across reboots.
  • The malware fetches PNG images from bestsocialmedianewspapper[.]com (with offlineupdater[.]com as failover) and reassembles executables/DLLs hidden in the image pixel data.
  • 1.bat executes the signed LockScreenContentServer.exe, which sideloads the malicious, forged-timestamp dui70.dll from the same directory.
  • The pasted PowerShell downloads verify_pkg.zip into a hidden, system-flagged staging directory under C:\ProgramData and silently runs 1.bat.
  • Victims on a compromised website (observed: linked-log[.]com) are shown a fake Cloudflare Turnstile CAPTCHA overlay instructing them to paste and run a PowerShell command.
  • Microsoft Threat Intelligence publishes a rapid-response research article documenting the active TerminalFix campaign.
  • Independent secondary reporting (The Hacker News, GBHackers, Cybersecurity News) corroborates the Microsoft findings and IOC set.

Sources cited for TerminalFix Campaign Deploys Custom Python Reverse-Tunnel

More in malware

Detection coverage for TL-2026-2260

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2260 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats