2026-08-31 · view entry permalink →
TerminalFix: a ClickFix variant that pastes into Terminal or PowerShell instead of Windows' Run dialog, then chains DLL sideloading, steganographic payload delivery and a custom reverse-tunnel implant
Microsoft Threat Intelligence documents TerminalFix, a ClickFix variant targeting organizations across multiple industries (Microsoft Threat Intelligence, 2026-08-28). A compromised website displays a fake Cloudflare Turnstile verification overlay that silently copies a malicious PowerShell command to the clipboard and instructs the user to paste it into Windows Terminal or PowerShell rather than Windows' Run dialog, which traditional ClickFix lures use; a console that runs complex, multi-line scripts far more reliably (Microsoft Threat Intelligence, 2026-08-28). Once pasted, the command downloads a ZIP archive containing a legitimate signed binary (LockScreenContentServer.exe) alongside a malicious dui70.dll masquerading as the Windows DirectUI Engine; the signed binary's static import dependency loads the planted DLL from its own working directory instead of System32, a DLL side-loading technique that starts execution inside a trusted, signed process (Microsoft Threat Intelligence, 2026-08-28).
The sideloaded DLL runs an elaborate second stage: PowerShell downloads three PNG images from attacker domains, extracts binary data hidden in their pixel channels (the first eight bytes of each embedded payload encode its length) and reassembles an executable and a DLL split across two of the images, deleting the source images afterward to reduce forensic artifacts (Microsoft Threat Intelligence, 2026-08-28). Persistence lands through both an HKCU\...\Run registry key and a scheduled task re-executing every 60 minutes, both under a masquerading name chosen to blend with the abused Lock Screen component, with the payload directory hidden via system and hidden file attributes. The malware then conducts extensive Active Directory reconnaissance, domain trust enumeration, domain admin group membership, user and computer discovery, and targeted pings of named infrastructure roles (domain controllers, databases, backup, gateways, mail), with the system-information-collection step run in English, Spanish and German locale variants, consistent with an operator or automated pre-assessment scoring whether the compromised host sits near high-value, domain-joined infrastructure (Microsoft Threat Intelligence, 2026-08-28).
The most significant capability is the final stage: an unmodified, signed embeddable Python 3.14.5 runtime pulled directly from python.org, launched with no visible window via pythonw.exe, running a custom client.py tunneling implant that dials out over TLS on port 443, upgrades to a WebSocket, and relays arbitrary TCP connections to any internal host and port the operator specifies, SOCKS5-style addressing over a custom 7-byte multiplexed protocol, indistinguishable on the wire from an ordinary encrypted web session (Microsoft Threat Intelligence, 2026-08-28). Combined with the reconnaissance data already gathered, this turns the compromised host into a full network pivot point. Microsoft states it did not observe the downstream hands-on-keyboard actions this access typically enables (privilege escalation, security-control tampering, data exfiltration, ransomware deployment) in the analyzed chain, but assesses the access itself makes those the expected next step (Microsoft Threat Intelligence, 2026-08-28).
While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully.
The client.py script is a compact but full-featured reverse tunnel. It dials outbound to the C2 over TLS/443, upgrades the session to a WebSocket, and uses that channel to relay arbitrary TCP connections on behalf of the operator. On the wire, the traffic is indistinguishable from an ordinary encrypted web session to a single destination
Organizations should treat affected devices as potential network pivot points and investigate for lateral movement and credential exposure.