# TerminalFix Campaign Deploys Custom Python Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA, DLL Sideloading, and PNG Steganography

> Microsoft Threat Intelligence documented TerminalFix, a ClickFix variant that lures users on compromised websites into pasting and executing malicious PowerShell into Windows Terminal (rather than the Run dialog) to reliably run complex multi-stage scripts. The chain uses DLL sideloading and steganographic PNG payload extraction to deploy client.py, a custom Python-based reverse-tunnel implant that proxies arbitrary TCP traffic over an encrypted WebSocket channel to gitnow[.]dev:443, followed by extensive Active Directory reconnaissance. Microsoft states it did not observe follow-on hands-on-keyboard actions (privilege escalation, security-control tampering, data exfiltration, ransomware) in the analyzed intrusion chain — the network-level access the tunnel grants creates the conditions for those outcomes, but they are an assessed risk, not a confirmed observed one.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2260
- **ID:** TL-2026-2260
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TerminalFix is a variant of the ClickFix social-engineering technique that Microsoft Threat Intelligence disclosed in a rapid-response research article on 2026-08-28. Victims land on a compromised website (observed example: linked-log[.]com) that overlays a spoofed Cloudflare Turnstile CAPTCHA verification page. Rather than directing the user to the Windows Run dialog — the classic ClickFix pattern — TerminalFix instructs the victim to paste and execute a PowerShell command inside Windows Terminal or a PowerShell console, which reliably supports longer, more complex multi-line scripts than the Run dialog's single-line input.

The pasted PowerShell downloads a ZIP archive (verify_pkg.zip) from attacker infrastructure into a concealed, hidden-and-system-flagged staging directory under C:\ProgramData (observed path fragment: f47f2a8c21c9df4e), then silently launches a batch file (1.bat). The batch file executes a legitimate, Microsoft-signed binary, LockScreenContentServer.exe, which is abused via classic DLL search-order sideloading to load a co-located malicious library, dui70.dll — an unsigned file masquerading as the Windows DirectUI Engine component, observed in at least eight hash variants and carrying a forged 2104 PE timestamp.

The malware then reaches out to bestsocialmedianewspapper[.]com and a failover host, offlineupdater[.]com, to download PNG images that conceal executables and DLL fragments steganographically embedded in pixel/RGBA channel data behind an 8-byte length prefix; these are reassembled on disk without ever touching the network as a directly-flagged binary. Persistence is established via Registry Run keys and a scheduled task that re-triggers roughly every 60 minutes.

The malware then stages an embeddable Python 3.14.5 runtime (the official python.org distribution) and launches client.py via the windowless pythonw.exe. client.py opens a reverse WebSocket tunnel over TLS 1.2 (certificate validation disabled, CERT_NONE) to gitnow[.]dev on port 443, using a custom 7-byte binary frame header (type + stream ID + length) to multiplex a SOCKS5-style TCP proxy — giving the operator direct network-level reach to any host visible from the compromised endpoint, plus a remote MSG_SHUTDOWN control message. Before or alongside tunnel setup, the implant performs extensive on-host and Active Directory reconnaissance: domain trust enumeration (nltest /domain_trusts, /dclist:), domain admin group membership (net group "domain admins" /domain), ADSI-based user/description harvesting, computer enumeration with targeted ping sweeps, and systeminfo collection localized in English, Spanish, and German — suggesting the toolkit is built for reuse against a non-English-speaking victim base.

Microsoft is explicit that it did not observe further hands-on-keyboard activity in the chains it analyzed: no privilege-escalation exploitation, no security-control tampering, no data exfiltration, and no ransomware deployment were confirmed. The company frames the SOCKS-style network pivot as creating the conditions under which an operator with interactive tunnel access could pursue those outcomes, not as something documented in this campaign to date. No CVE is associated with the intrusion chain (it depends on social engineering and living-off-the-land execution, not a software vulnerability), no specific victim sector or region is disclosed beyond "multiple industries," and no threat actor group has been attributed.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1027.003 Steganography
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1018 Remote System Discovery
- T1069.002 Domain Groups
- T1482 Domain Trust Discovery
- T1087.002 Domain Account
- T1082 System Information Discovery
- T1572 Protocol Tunneling
- T1071.001 Web Protocols

## Sources

- [TerminalFix campaign deploys a reverse tunnel through multistage intrusion](https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/)
- [TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor](https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html)
- [Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel Backdoor](https://gbhackers.com/hackers-use-fake-cloudflare-captcha/)
- [Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Enterprise Networks](https://cybersecuritynews.com/fake-cloudflare-captcha/)
- [Think before you Click(Fix): Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2260