TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage Intrusion — Threadlinqs Intelligence
As of 2026-08-31, TerminalFix Campaign Deploys Custom Reverse-Tunnel Implant via Fake Cloudflare CAPTCHA and Multistage Intrusion is a critical-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-2265 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Microsoft Threat Intelligence documents TerminalFix, a ClickFix-variant campaign that lures users on compromised websites into pasting malicious PowerShell into Windows Terminal via a fake Cloudflare
TerminalFix is a more capable ClickFix variant identified by Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) and disclosed on 2026-08-28. Unlike traditional ClickFix lures that abuse the Windows Run dialog, TerminalFix directs victims on compromised websites (e.g. linked-log.com) to open Windows Terminal or PowerShell and paste a command copied by a spoofed Cloudflare Turnstile 'Verify you are human' overlay, increasing the likelihood that complex, multi-line scripts execute successfully.
The pasted PowerShell command clears the terminal, displays fake verification messaging, and downloads a ZIP archive (verify_pkg.zip) to C:\ProgramData\f47f2a8c21c9df4e, then silently launches 1.bat to run LockScreenContentServer.exe, a legitimate Microsoft-signed binary with a static import dependency on dui70.dll. Because the Windows loader resolves the application directory before System32, the attacker's malicious dui70.dll placed alongside the legitimate executable is loaded instead (DLL side-loading, T1574.002).
The sideloaded DLL runs a PowerShell routine (Extract-RawFileFromImage) that downloads ostensibly harmless PNG images from bestsocialmedianewspapper.com and offlineupdater.com (failover) and extracts hidden payload bytes from their pixel/RGBA channels -- the first 8 bytes of extracted data encode a 64-bit payload length, with the remainder reconstructing executables and DLL fragments (including split components reassembled across multiple images), ultimately materializing the client.py tunnel implant on disk.
Persistence is established via an HKCU Run key masquerading as a Windows Lock Screen component, and a scheduled task (LockScreenContentServer_MuODG5yBM) that re-executes LockScreenContentServer.exe every 60 minutes; the staging directory is hidden with attrib +h +s. A persistent PowerShell file-watch loop then polls text files for attacker commands, executes them via Invoke-Expression, and writes results back out -- a primitive asynchronous command shell.
Before deploying the tunnel, the malware performs extensive Active Directory reconnaissance using nltest /domain_trusts and /dclist:, net group "domain admins" /domain, ADSI-based user-description harvesting, and ADSI queries identifying Windows Server hosts combined with targeted ping sweeps; reconnaissance scripts ship with English, Spanish, and German locale variants for cross-language environments.
Finally, an unmodified Python 3.14.5 embeddable runtime is downloaded from the official python.org distribution and used to run client.py via pythonw.exe with no visible window. The implant opens an outbound TLS connection on port 443 to gitnow.dev, upgrades the session to a WebSocket at the /tunnel endpoint (with certificate verification permanently disabled, CERT_NONE), and uses a custom 7-byte binary protocol header (type + stream ID + length) to multiplex SOCKS5-style arbitrary TCP connections to any internal host and port reachable from the victim, rotating Chrome/Firefox/Safari User-Agent strings per connection and supporting remote termination via MSG_SHUTDOWN/os._exit(). This turns the compromised host into a full network pivot point reaching domain controllers, databases, backup systems, gateways, and mail systems identified during reconnaissance.
Microsoft states the implant provides 'direct access to an organization's internal network' and that organizations should treat a confirmed infection as potential network-level compromise -- not simple malware cleanup -- and prioritize rotating credentials, including domain admin accounts, reachable from the affected host. Microsoft Defender XDR coverage includes Trojan:Win32/ClickFix.*, Trojan:Win32/TermFix.*, Trojan:Win32/Posilod.*, Trojan:Win64/DLLHijack.DAB!MTB, and Trojan:Python/Indigo.SA. Microsoft states it did not observe further post-exploitation actions (e.g. ransomware deployment) in the analyzed samples, but assesses the reconnaissance-plus-tunnel combination as consi
Timeline
- Malpedia catalogs the TerminalFix campaign (entry win.lorem_ipsum), referencing Microsoft's forthcoming technical writeup.
- Microsoft Threat Intelligence (Parasharan Raghavan, Sagar Patil, Suriyaraj Natarajan) publishes the original TerminalFix analysis on the Microsoft Security Blog, detailing the eight-stage intrusion chain.
- Microsoft documents victims on compromised websites (e.g. linked-log.com) being shown a spoofed Cloudflare Turnstile CAPTCHA that copies a malicious PowerShell command to the clipboard for paste-and-run execution in Windows Terminal.
- Reported delivery of the ZIP archive verify_pkg.zip containing the legitimate LockScreenContentServer.exe, which is abused to sideload the malicious dui70.dll from C:\ProgramData\f47f2a8c21c9df4e.
- Documented steganographic extraction of executable/DLL fragments (including the client.py implant) from PNG images hosted on bestsocialmedianewspapper.com and offlineupdater.com.
- Reported establishment of persistence via an HKCU Run key and the hourly scheduled task LockScreenContentServer_MuODG5yBM, with the staging directory hidden via attrib +h +s.
- Documented Active Directory reconnaissance using nltest /domain_trusts, nltest /dclist:, net group "domain admins" /domain, and ADSI-based user/computer enumeration with locale variants in English, Spanish, and German.
- Reported deployment of the client.py implant via pythonw.exe, establishing an encrypted TLS/443 WebSocket tunnel to gitnow.dev for SOCKS5-style internal network proxying.
- BleepingComputer, The Hacker News, CybersecurityNews, and GBHackers publish independent corroborating coverage of Microsoft's TerminalFix disclosure.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1204.004, T1059.001, T1574.001, T1027.003, T1564.001, T1036.005, T1547.001, T1053.005, T1482, T1069.002
