TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL Sideloading, and PNG Steganography — Threadlinqs Intelligence
As of 2026-08-31, TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL Sideloading, and PNG Steganography is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-2260 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Microsoft Threat Intelligence documented TerminalFix, a ClickFix variant that lures users on compromised websites into pasting and executing malicious PowerShell into Windows Terminal (rather than the
TerminalFix is a variant of the ClickFix social-engineering technique that Microsoft Threat Intelligence disclosed in a rapid-response research article on 2026-08-28. Victims land on a compromised website (observed example: linked-log[.]com) that overlays a spoofed Cloudflare Turnstile CAPTCHA verification page. Rather than directing the user to the Windows Run dialog — the classic ClickFix pattern — TerminalFix instructs the victim to paste and execute a PowerShell command inside Windows Terminal or a PowerShell console, which reliably supports longer, more complex multi-line scripts than the Run dialog's single-line input.
The pasted PowerShell downloads a ZIP archive (verify_pkg.zip) from attacker infrastructure into a concealed, hidden-and-system-flagged staging directory under C:\ProgramData (observed path fragment: f47f2a8c21c9df4e), then silently launches a batch file (1.bat). The batch file executes a legitimate, Microsoft-signed binary, LockScreenContentServer.exe, which is abused via classic DLL search-order sideloading to load a co-located malicious library, dui70.dll — an unsigned file masquerading as the Windows DirectUI Engine component, observed in at least eight hash variants and carrying a forged 2104 PE timestamp.
The malware then reaches out to bestsocialmedianewspapper[.]com and a failover host, offlineupdater[.]com, to download PNG images that conceal executables and DLL fragments steganographically embedded in pixel/RGBA channel data behind an 8-byte length prefix; these are reassembled on disk without ever touching the network as a directly-flagged binary. Persistence is established via Registry Run keys and a scheduled task that re-triggers roughly every 60 minutes.
The malware then stages an embeddable Python 3.14.5 runtime (the official python.org distribution) and launches client.py via the windowless pythonw.exe. client.py opens a reverse WebSocket tunnel over TLS 1.2 (certificate validation disabled, CERT_NONE) to gitnow[.]dev on port 443, using a custom 7-byte binary frame header (type + stream ID + length) to multiplex a SOCKS5-style TCP proxy — giving the operator direct network-level reach to any host visible from the compromised endpoint, plus a remote MSG_SHUTDOWN control message. Before or alongside tunnel setup, the implant performs extensive on-host and Active Directory reconnaissance: domain trust enumeration (nltest /domain_trusts, /dclist:), domain admin group membership (net group "domain admins" /domain), ADSI-based user/description harvesting, computer enumeration with targeted ping sweeps, and systeminfo collection localized in English, Spanish, and German — suggesting the toolkit is built for reuse against a non-English-speaking victim base.
Microsoft is explicit that it did not observe further hands-on-keyboard activity in the chains it analyzed: no privilege-escalation exploitation, no security-control tampering, no data exfiltration, and no ransomware deployment were confirmed. The company frames the SOCKS-style network pivot as creating the conditions under which an operator with interactive tunnel access could pursue those outcomes, not as something documented in this campaign to date. No CVE is associated with the intrusion chain (it depends on social engineering and living-off-the-land execution, not a software vulnerability), no specific victim sector or region is disclosed beyond "multiple industries," and no threat actor group has been attributed.
Target sectors: multiple industries
Timeline
- Microsoft Threat Intelligence publishes a rapid-response research article documenting the active TerminalFix campaign.
- Victims on a compromised website (observed: linked-log[.]com) are shown a fake Cloudflare Turnstile CAPTCHA overlay instructing them to paste and run a PowerShell command.
- The pasted PowerShell downloads verify_pkg.zip into a hidden, system-flagged staging directory under C:\ProgramData and silently runs 1.bat.
- 1.bat executes the signed LockScreenContentServer.exe, which sideloads the malicious, forged-timestamp dui70.dll from the same directory.
- The malware fetches PNG images from bestsocialmedianewspapper[.]com (with offlineupdater[.]com as failover) and reassembles executables/DLLs hidden in the image pixel data.
- Registry Run key and an approximately 60-minute-interval scheduled task are created to maintain persistence across reboots.
- The implant runs domain trust, domain admin, ADSI user/computer, and multilingual systeminfo reconnaissance commands against the victim's Active Directory environment.
- An embedded Python 3.14.5 runtime launches client.py via pythonw.exe, opening a TLS WebSocket reverse tunnel to gitnow[.]dev:443 for SOCKS-style TCP proxying.
- Microsoft states it did not observe further hands-on-keyboard actions (privilege escalation, security-control tampering, exfiltration, ransomware) in the chains it analyzed.
- Independent secondary reporting (The Hacker News, GBHackers, Cybersecurity News) corroborates the Microsoft findings and IOC set.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.001, T1204.002, T1547.001, T1053.005, T1574.001, T1027.003, T1036.005, T1564.001, T1018, T1069.002
