TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage Intrusion

TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant (TL-2026-2265) is a critical-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Microsoft Windows (Windows Terminal / PowerShell execution, maps to 16 MITRE ATT&CK techniques (T1018, T1027.003, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-2265

Threat ID
TL-2026-2265
Severity
CRITICAL
Status
ACTIVE
Category
MALWARE
First published
2026-08-31
Last reviewed
2026-08-31
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
20

Malware and tooling in TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant

Malware and tooling: TerminalFix

Microsoft Threat Intelligence documents TerminalFix, a ClickFix-variant campaign that lures users on compromised websites into pasting malicious PowerShell into Windows Terminal via a fake Cloudflare Turnstile CAPTCHA overlay. The eight-stage chain combines DLL sideloading of a signed LockScreenContentServer.exe/dui70.dll pair, PNG-steganographic payload extraction, dual registry/scheduled-task persistence, Active Directory reconnaissance, and a custom Python reverse-tunnel implant (client.py) that gives the attacker encrypted, network-level proxy access.

How TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant works

TerminalFix is a more capable ClickFix variant identified by Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) and disclosed on 2026-08-28. Unlike traditional ClickFix lures that abuse the Windows Run dialog, TerminalFix directs victims on compromised websites (e.g. linked-log.com) to open Windows Terminal or PowerShell and paste a command copied by a spoofed Cloudflare Turnstile 'Verify you are human' overlay, increasing the likelihood that complex, multi-line scripts execute successfully.

The pasted PowerShell command clears the terminal, displays fake verification messaging, and downloads a ZIP archive (verify_pkg.zip) to C:\ProgramData\f47f2a8c21c9df4e, then silently launches 1.bat to run LockScreenContentServer.exe, a legitimate Microsoft-signed binary with a static import dependency on dui70.dll. Because the Windows loader resolves the application directory before System32, the attacker's malicious dui70.dll placed alongside the legitimate executable is loaded instead (DLL side-loading, T1574.002).

The sideloaded DLL runs a PowerShell routine (Extract-RawFileFromImage) that downloads ostensibly harmless PNG images from bestsocialmedianewspapper.com and offlineupdater.com (failover) and extracts hidden payload bytes from their pixel/RGBA channels -- the first 8 bytes of extracted data encode a 64-bit payload length, with the remainder reconstructing executables and DLL fragments (including split components reassembled across multiple images), ultimately materializing the client.py tunnel implant on disk.

Persistence is established via an HKCU Run key masquerading as a Windows Lock Screen component, and a scheduled task (LockScreenContentServer_MuODG5yBM) that re-executes LockScreenContentServer.exe every 60 minutes; the staging directory is hidden with attrib +h +s. A persistent PowerShell file-watch loop then polls text files for attacker commands, executes them via Invoke-Expression, and writes results back out -- a primitive asynchronous command shell.

Before deploying the tunnel, the malware performs extensive Active Directory reconnaissance using nltest /domain_trusts and /dclist:, net group "domain admins" /domain, ADSI-based user-description harvesting, and ADSI queries identifying Windows Server hosts combined with targeted ping sweeps; reconnaissance scripts ship with English, Spanish, and German locale variants for cross-language environments.

Finally, an unmodified Python 3.14.5 embeddable runtime is downloaded from the official python.org distribution and used to run client.py via pythonw.exe with no visible window. The implant opens an outbound TLS connection on port 443 to gitnow.dev, upgrades the session to a WebSocket at the /tunnel endpoint (with certificate verification permanently disabled, CERT_NONE), and uses a custom 7-byte binary protocol header (type + stream ID + length) to multiplex SOCKS5-style arbitrary TCP connections to any internal host and port reachable from the victim, rotating Chrome/Firefox/Safari User-Agent strings per connection and supporting remote termination via MSG_SHUTDOWN/os._exit(). This turns the compromised host into a full network pivot point reaching domain controllers, databases, backup systems, gateways, and mail systems identified during reconnaissance.

Microsoft states the implant provides 'direct access to an organization's internal network' and that organizations should treat a confirmed infection as potential network-level compromise -- not simple malware cleanup -- and prioritize rotating credentials, including domain admin accounts, reachable from the affected host. Microsoft Defender XDR coverage includes Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, and Trojan:Python/Indigo.SA. Microsoft states it did not observe further post-exploitation actions (e.g. ransomware deployment) in the analyzed samples, but assesses the reconnaissance-plus-tunnel combination as consistent with an imminent risk of lateral movement, credential theft, data exfiltration, or ransomware deployment. No CVE applies; this is a social-engineering delivery chain combined with custom malware, not a software vulnerability.

MITRE ATT&CK techniques used in TL-2026-2265

Discovery

T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery

Defense Evasion

T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1090.001 Internal Proxy; T1572 Protocol Tunneling

Affected products and versions in TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant

  • Microsoft — Windows (Windows Terminal / PowerShell execution environment)
    Vulnerable versions: Any supported Windows version with Windows Terminal and/or PowerShell available to the user
    Fixed in: N/A -- social-engineering delivery chain abusing legitimate OS components, not a patchable vulnerability

Remediation for TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant

Patches

  • N/A -- delivery relies on social engineering and DLL side-loading of a legitimately signed binary, not an unpatched software vulnerability; no CVE applies

Immediate actions

  • Treat any host confirmed to have executed the ClickFix PowerShell/DLL-sideload chain as having potential network-level access, not merely a malware infection; prioritize rotating credentials -- including domain admin accounts -- reachable from the affected host
  • Block and alert on outbound connections to gitnow.dev:443, bestsocialmedianewspapper.com, and offlineupdater.com
  • Hunt for LockScreenContentServer.exe executing outside its normal C:\Windows\SystemApps path and for dui70.dll being loaded alongside it from non-standard directories
  • Hunt for pythonw.exe/python.exe processes referencing client.py, --server, --uuid, cert.pem, or gitnow.dev on the command line
  • Investigate confirmed infections for evidence of lateral movement and exposed credentials before considering the incident closed

Workarounds

  • Audit or block the Windows Run dialog and restrict direct Windows Terminal/PowerShell access on endpoints where it is not required for the user's role

Longer-term hardening

  • Restrict PowerShell, Windows Terminal, and the Run dialog (Win+R) via AppLocker or Windows Defender Application Control where not operationally required
  • Enable PowerShell script block logging and enforce Constrained Language Mode with AllSigned/RemoteSigned execution policy
  • Configure Windows Terminal to warn on multi-line paste events
  • Deploy attack surface reduction rules blocking obfuscated script execution and abnormal executable prevalence
  • Enable cloud-delivered protection in Microsoft Defender Antivirus and network/web protection in Microsoft Defender for Endpoint
  • Run recurring security-awareness training reinforcing that legitimate CAPTCHA verification never asks a user to paste commands into a terminal

Timeline of TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant

  • Malpedia catalogs the TerminalFix campaign (entry win.lorem_ipsum), referencing Microsoft's forthcoming technical writeup.
  • BleepingComputer, The Hacker News, CybersecurityNews, and GBHackers publish independent corroborating coverage of Microsoft's TerminalFix disclosure.
  • Reported deployment of the client.py implant via pythonw.exe, establishing an encrypted TLS/443 WebSocket tunnel to gitnow.dev for SOCKS5-style internal network proxying.
  • Documented Active Directory reconnaissance using nltest /domain_trusts, nltest /dclist:, net group "domain admins" /domain, and ADSI-based user/computer enumeration with locale variants in English, Spanish, and German.
  • Reported establishment of persistence via an HKCU Run key and the hourly scheduled task LockScreenContentServer_MuODG5yBM, with the staging directory hidden via attrib +h +s.
  • Documented steganographic extraction of executable/DLL fragments (including the client.py implant) from PNG images hosted on bestsocialmedianewspapper.com and offlineupdater.com.
  • Reported delivery of the ZIP archive verify_pkg.zip containing the legitimate LockScreenContentServer.exe, which is abused to sideload the malicious dui70.dll from C:\ProgramData\f47f2a8c21c9df4e.
  • Microsoft documents victims on compromised websites (e.g. linked-log.com) being shown a spoofed Cloudflare Turnstile CAPTCHA that copies a malicious PowerShell command to the clipboard for paste-and-run execution in Windows Terminal.
  • Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) publishes the original TerminalFix analysis on the Microsoft Security Blog, detailing the eight-stage intrusion chain.

Sources cited for TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant

More in malware

Detection coverage for TL-2026-2265

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2265 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats