Executive Summary
On 28 August 2026, Microsoft Threat intelligence reported details of what they have dubbed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. The PowerShell command masquerades as a Cloudflare verification process while downloading a ZIP archive containing a legitimate binary and a malicious DLL used for sideloading. This TerminalFix campaign deploys a sophisticated multi-stage attack chain that combines DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant. Microsoft has provided Indicators of Compromise included with this campaign, which are included below.
Key Takeaways
- While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully.
- Because the Windows loader resolves the application directory before the System32 directory, the planted DLL is loaded in place of the legitimate one, a technique known as DLL sideloading. Execution therefore begins inside a trusted, signed process, allowing the attacker to inherit its reputation and evade controls that key on process identity.
- The sideloaded DLL launches an elaborate PowerShell script that downloads three images from attacker-controlled domains, extracts binary data encoded in pixel values, and reassembles the components on disk.
- After establishing persistence, the sideloaded malware conducts extensive reconnaissance of the victim environment and deploys a Python runtime and a custom tunneling implant that gives the attacker full TCP proxy access through the victim network.
- Organizations should treat affected devices as potential network pivot points and investigate for lateral movement and credential exposure. Alert on LockScreenContentServer[.]exe executing from non-standard paths to identify this activity across your environment.
Indicators of Compromise
Microsoft has provided Indicators of Compromise included with this campaign, which are included below in their entirety.
File Indicators
Indicator |
Description |
18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f |
Initial ZIP archive (verify_pkg.zip) |
b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a |
Custom tunnel implant (client.py) |
ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07 |
Malicious DLL (dui70.dll) |
026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab |
Malicious DLL (dui70.dll) |
032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22 |
Malicious DLL (dui70.dll) |
df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf |
Malicious DLL (dui70.dll) |
eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0 |
Malicious DLL (dui70.dll) |
5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8 |
Malicious DLL (dui70.dll) |
9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24 |
Malicious DLL (dui70.dll) |
342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e |
Malicious DLL (dui70.dll) |
ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d |
Malicious DLL (dui70.dll) |
Network Indicators
Indicator |
Type |
Description |
gitnow[.]dev |
Domain |
C2 server for custom reverse tunnel implant (port 443) |
bestsocialmedianewspapper[.]com |
Domain |
Steganographic image hosting / payload delivery |
offlineupdater[.]com |
Domain |
Steganographic image hosting / failover |
hxxps://linked-log[.]com/ |
Domain |
Compromised website |
