TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage Intrusion
TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant (TL-2026-2265) is a critical-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Microsoft Windows (Windows Terminal / PowerShell execution, maps to 16 MITRE ATT&CK techniques (T1018, T1027.003, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2265
- Threat ID
- TL-2026-2265
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-31
- Last reviewed
- 2026-08-31
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant
Malware and tooling: TerminalFix
Microsoft Threat Intelligence documents TerminalFix, a ClickFix-variant campaign that lures users on compromised websites into pasting malicious PowerShell into Windows Terminal via a fake Cloudflare Turnstile CAPTCHA overlay. The eight-stage chain combines DLL sideloading of a signed LockScreenContentServer.exe/dui70.dll pair, PNG-steganographic payload extraction, dual registry/scheduled-task persistence, Active Directory reconnaissance, and a custom Python reverse-tunnel implant (client.py) that gives the attacker encrypted, network-level proxy access.
How TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant works
TerminalFix is a more capable ClickFix variant identified by Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) and disclosed on 2026-08-28. Unlike traditional ClickFix lures that abuse the Windows Run dialog, TerminalFix directs victims on compromised websites (e.g. linked-log.com) to open Windows Terminal or PowerShell and paste a command copied by a spoofed Cloudflare Turnstile 'Verify you are human' overlay, increasing the likelihood that complex, multi-line scripts execute successfully.
The pasted PowerShell command clears the terminal, displays fake verification messaging, and downloads a ZIP archive (verify_pkg.zip) to C:\ProgramData\f47f2a8c21c9df4e, then silently launches 1.bat to run LockScreenContentServer.exe, a legitimate Microsoft-signed binary with a static import dependency on dui70.dll. Because the Windows loader resolves the application directory before System32, the attacker's malicious dui70.dll placed alongside the legitimate executable is loaded instead (DLL side-loading, T1574.002).
The sideloaded DLL runs a PowerShell routine (Extract-RawFileFromImage) that downloads ostensibly harmless PNG images from bestsocialmedianewspapper.com and offlineupdater.com (failover) and extracts hidden payload bytes from their pixel/RGBA channels -- the first 8 bytes of extracted data encode a 64-bit payload length, with the remainder reconstructing executables and DLL fragments (including split components reassembled across multiple images), ultimately materializing the client.py tunnel implant on disk.
Persistence is established via an HKCU Run key masquerading as a Windows Lock Screen component, and a scheduled task (LockScreenContentServer_MuODG5yBM) that re-executes LockScreenContentServer.exe every 60 minutes; the staging directory is hidden with attrib +h +s. A persistent PowerShell file-watch loop then polls text files for attacker commands, executes them via Invoke-Expression, and writes results back out -- a primitive asynchronous command shell.
Before deploying the tunnel, the malware performs extensive Active Directory reconnaissance using nltest /domain_trusts and /dclist:, net group "domain admins" /domain, ADSI-based user-description harvesting, and ADSI queries identifying Windows Server hosts combined with targeted ping sweeps; reconnaissance scripts ship with English, Spanish, and German locale variants for cross-language environments.
Finally, an unmodified Python 3.14.5 embeddable runtime is downloaded from the official python.org distribution and used to run client.py via pythonw.exe with no visible window. The implant opens an outbound TLS connection on port 443 to gitnow.dev, upgrades the session to a WebSocket at the /tunnel endpoint (with certificate verification permanently disabled, CERT_NONE), and uses a custom 7-byte binary protocol header (type + stream ID + length) to multiplex SOCKS5-style arbitrary TCP connections to any internal host and port reachable from the victim, rotating Chrome/Firefox/Safari User-Agent strings per connection and supporting remote termination via MSG_SHUTDOWN/os._exit(). This turns the compromised host into a full network pivot point reaching domain controllers, databases, backup systems, gateways, and mail systems identified during reconnaissance.
Microsoft states the implant provides 'direct access to an organization's internal network' and that organizations should treat a confirmed infection as potential network-level compromise -- not simple malware cleanup -- and prioritize rotating credentials, including domain admin accounts, reachable from the affected host. Microsoft Defender XDR coverage includes Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, and Trojan:Python/Indigo.SA. Microsoft states it did not observe further post-exploitation actions (e.g. ransomware deployment) in the analyzed samples, but assesses the reconnaissance-plus-tunnel combination as consistent with an imminent risk of lateral movement, credential theft, data exfiltration, or ransomware deployment. No CVE applies; this is a social-engineering delivery chain combined with custom malware, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-2265
Discovery
T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery
Defense Evasion
T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1572 Protocol Tunneling
Affected products and versions in TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant
- Microsoft — Windows (Windows Terminal / PowerShell execution environment)
Vulnerable versions: Any supported Windows version with Windows Terminal and/or PowerShell available to the user
Fixed in: N/A -- social-engineering delivery chain abusing legitimate OS components, not a patchable vulnerability
Remediation for TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant
Patches
- N/A -- delivery relies on social engineering and DLL side-loading of a legitimately signed binary, not an unpatched software vulnerability; no CVE applies
Immediate actions
- Treat any host confirmed to have executed the ClickFix PowerShell/DLL-sideload chain as having potential network-level access, not merely a malware infection; prioritize rotating credentials -- including domain admin accounts -- reachable from the affected host
- Block and alert on outbound connections to gitnow.dev:443, bestsocialmedianewspapper.com, and offlineupdater.com
- Hunt for LockScreenContentServer.exe executing outside its normal C:\Windows\SystemApps path and for dui70.dll being loaded alongside it from non-standard directories
- Hunt for pythonw.exe/python.exe processes referencing client.py, --server, --uuid, cert.pem, or gitnow.dev on the command line
- Investigate confirmed infections for evidence of lateral movement and exposed credentials before considering the incident closed
Workarounds
- Audit or block the Windows Run dialog and restrict direct Windows Terminal/PowerShell access on endpoints where it is not required for the user's role
Longer-term hardening
- Restrict PowerShell, Windows Terminal, and the Run dialog (Win+R) via AppLocker or Windows Defender Application Control where not operationally required
- Enable PowerShell script block logging and enforce Constrained Language Mode with AllSigned/RemoteSigned execution policy
- Configure Windows Terminal to warn on multi-line paste events
- Deploy attack surface reduction rules blocking obfuscated script execution and abnormal executable prevalence
- Enable cloud-delivered protection in Microsoft Defender Antivirus and network/web protection in Microsoft Defender for Endpoint
- Run recurring security-awareness training reinforcing that legitimate CAPTCHA verification never asks a user to paste commands into a terminal
Timeline of TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant
- Malpedia catalogs the TerminalFix campaign (entry win.lorem_ipsum), referencing Microsoft's forthcoming technical writeup.
- BleepingComputer, The Hacker News, CybersecurityNews, and GBHackers publish independent corroborating coverage of Microsoft's TerminalFix disclosure.
- Reported deployment of the client.py implant via pythonw.exe, establishing an encrypted TLS/443 WebSocket tunnel to gitnow.dev for SOCKS5-style internal network proxying.
- Documented Active Directory reconnaissance using nltest /domain_trusts, nltest /dclist:, net group "domain admins" /domain, and ADSI-based user/computer enumeration with locale variants in English, Spanish, and German.
- Reported establishment of persistence via an HKCU Run key and the hourly scheduled task LockScreenContentServer_MuODG5yBM, with the staging directory hidden via attrib +h +s.
- Documented steganographic extraction of executable/DLL fragments (including the client.py implant) from PNG images hosted on bestsocialmedianewspapper.com and offlineupdater.com.
- Reported delivery of the ZIP archive verify_pkg.zip containing the legitimate LockScreenContentServer.exe, which is abused to sideload the malicious dui70.dll from C:\ProgramData\f47f2a8c21c9df4e.
- Microsoft documents victims on compromised websites (e.g. linked-log.com) being shown a spoofed Cloudflare Turnstile CAPTCHA that copies a malicious PowerShell command to the clipboard for paste-and-run execution in Windows Terminal.
- Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) publishes the original TerminalFix analysis on the Microsoft Security Blog, detailing the eight-stage intrusion chain.
Sources cited for TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant
- TerminalFix campaign deploys a reverse tunnel through multistage intrusion
- Microsoft warns of TerminalFix attacks deploying reverse tunnels
- TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Malware
- TerminalFix (win.lorem_ipsum) Malpedia entry
- Hackers Use Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks
- Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel
More in malware
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
Detection coverage for TL-2026-2265
As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2265 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.