TerminalFix: a ClickFix variant that pastes into Terminal or PowerShell instead of Windows' Run dialog, then chains DLL sideloading, steganographic payload delivery and a custom reverse-tunnel implant
The fake-CAPTCHA lure now targets a console that can run multi-line scripts, not the one-line Run box
Analysis
Microsoft Threat Intelligence documents TerminalFix, a ClickFix variant targeting organizations across multiple industries (Microsoft Threat Intelligence, 2026-08-28). A compromised website displays a fake Cloudflare Turnstile verification overlay that silently copies a malicious PowerShell command to the clipboard and instructs the user to paste it into Windows Terminal or PowerShell rather than Windows' Run dialog, which traditional ClickFix lures use; a console runs complex, multi-line scripts far more reliably (Microsoft Threat Intelligence, 2026-08-28). Once pasted, the command downloads a ZIP archive containing a legitimate signed binary (LockScreenContentServer.exe) alongside a malicious dui70.dll masquerading as the Windows DirectUI Engine; the signed binary's static import dependency loads the planted DLL from its own working directory instead of System32, a DLL side-loading technique that starts execution inside a trusted, signed process (Microsoft Threat Intelligence, 2026-08-28).
The sideloaded DLL runs an elaborate second stage: PowerShell downloads three PNG images from attacker domains, extracts binary data hidden in their pixel channels (the first eight bytes of each embedded payload encode its length) and reassembles an executable and a DLL split across two of the images, deleting the source images afterward to reduce forensic artifacts (Microsoft Threat Intelligence, 2026-08-28). Persistence lands through both an HKCU\...\Run registry key and a scheduled task re-executing every 60 minutes, both under a masquerading name chosen to blend with the abused Lock Screen component, with the payload directory hidden via system and hidden file attributes (Microsoft Threat Intelligence, 2026-08-28). The malware then conducts extensive Active Directory reconnaissance: domain trust enumeration, domain admin group membership, user and computer discovery, and targeted pings of named infrastructure roles (domain controllers, databases, backup, gateways, mail), with the system-information-collection step run in English, Spanish and German locale variants, consistent with an operator or automated pre-assessment scoring whether the compromised host sits near high-value, domain-joined infrastructure (Microsoft Threat Intelligence, 2026-08-28).
The most significant capability is the final stage: an unmodified, signed embeddable Python 3.14.5 runtime pulled directly from python.org, launched with no visible window via pythonw.exe, running a custom client.py tunneling implant that dials out over TLS on port 443, upgrades to a WebSocket, and relays arbitrary TCP connections to any internal host and port the operator specifies: SOCKS5-style addressing over a custom 7-byte multiplexed protocol, indistinguishable on the wire from an ordinary encrypted web session (Microsoft Threat Intelligence, 2026-08-28). Combined with the reconnaissance data already gathered, this turns the compromised host into a full network pivot point. Microsoft states it did not observe the downstream hands-on-keyboard actions this access typically enables (privilege escalation, security-control tampering, data exfiltration, ransomware deployment) in the analyzed chain, but assesses the access itself makes those the expected next step (Microsoft Threat Intelligence, 2026-08-28).
Cited evidence
While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully.
The client.py script is a compact but full-featured reverse tunnel. It dials outbound to the C2 over TLS/443, upgrades the session to a WebSocket, and uses that channel to relay arbitrary TCP connections on behalf of the operator. On the wire, the traffic is indistinguishable from an ordinary encrypted web session to a single destination
Organizations should treat affected devices as potential network pivot points and investigate for lateral movement and credential exposure.
To the BSI's knowledge, this malware is attributed to the same financially motivated group responsible for the Rhysida ransomware and leak site. (translated from German)
TerminalFix is not linked to a specific threat group or a single campaign.
Table 1 lists the sideload pairings that Sophos analysts observed between March and September.
This loader attempts to evade entropy-based detections by storing shellcode bytes as English words rather than raw binary data.
However, Sophos analysts have not observed encryption in the STAC4924 campaign.
Updates2
Germany's BSI published an advisory on 2026-09-04 describing the compromise of an anonymized "state institution" whose technique matches this campaign; the advisory itself never names Berlin (BSI, BITS-2026-287419-1032, 2026-09-04). The same day, BSI posted on its official Mastodon account that it was intensively involved in handling the Berlin incident and separately linked to its detailed TerminalFix security notice (BSI on Mastodon, 2026-09-04); heise reports that juxtaposition as confirmation that TerminalFix is specifically the vector Rhysida's operators used against Berlin's two affected Senate administrations (heise online, citing BSI, 2026-09-07), the first independent confirmation of this campaign beyond Microsoft's own telemetry, and its first named-actor attribution. BSI attributes the campaign, via a malware family it names LoremIpsumLoader (also known as AxolotLoader) observed in incident reports, to a financially motivated group it tracks as Vice Spider, the same group responsible for the Rhysida ransomware and leak site, cross-referenced against the aliases Vice Society, WhiteNefas, White Hekate, DEV-0832 and Vanilla Tempest (BSI, BITS-2026-287419-1032, 2026-09-04). BSI assesses the campaign as opportunistic, purely financially motivated cybercrime with no established state or political link, and notes the CAPTCHA lure's own JavaScript has been observed on several hundred historical websites, evidence of a reusable watering-hole kit rather than one-off, victim-specific infrastructure (BSI, BITS-2026-287419-1032, 2026-09-04).
Sophos X-Ops reports a campaign it tracks as STAC4924, active since at least March, in two phases, whose tooling and tradecraft closely align with this chain (Sophos X-Ops, 2026-09-30). The first, in March and April, used SEO-poisoned websites distributing trojanized Microsoft Teams installer packages; from late May the campaign moved to TerminalFix lures, a shift Sophos says coincided with Microsoft's takedown of the malware-signing service that supplied the fraudulently obtained certificates (Sophos X-Ops, 2026-09-30). Sophos assesses with moderate confidence that the two phases are linked to the same group or closely associated actors, on the shared per-victim identifier callback and the use of a legitimate community platform as a dead-drop resolver for C2 addresses, and adds that the TerminalFix lure itself is not linked to a specific threat group or a single campaign, since several 2026 campaigns have used it (Sophos X-Ops, 2026-09-30).
Sophos lists 19 pairings of a legitimate executable and a malicious DLL observed between March and September, not only the lock-screen binary with dui70.dll: they include changepk.exe, werfaultsecure.exe, wuauclt.exe and embeddedapplauncher.exe, and helper executables named after Microsoft Edge and Teams (Sophos X-Ops, 2026-09-30). The loader stores shellcode bytes as English words with a separate lookup table to evade entropy-based detections, reads an attacker-controlled profile on the community platform to decode the current C2 server list, and then talks to C2 over HTTP POST requests that appear to carry JPEG images but hold encoded data (Sophos X-Ops, 2026-09-30).
BlueVoyant attributed the loader to the Rapid Brigantine group, which Sophos tracks as GOLD VICTOR (also known as Vanilla Tempest, DEV-0832, VICE SPIDER and Vice Society) and which has been linked to the Vice Society and Rhysida ransomware families; Sophos says its STAC4924 observations support that attribution but that it has not observed encryption in the campaign (Sophos X-Ops, 2026-09-30).
Sources5
Revision history
- Published 2026-08-31T0411Z-intel
- Update 2026-09-08T0411Z-intel
Germany's BSI independently confirms this campaign's technique against a real-world case it investigated (the Berlin Landesnetz compromise) and supplies the campaign's first named-actor attribution: Rhysida's operators, tracked by BSI as Vice Spider. Verification moves from single-source to multi-source; credibility moves from 2 to 1 on the same independent national-CERT confirmation that moved the sibling Berlin entry.
Changed: updated_at entities tags sources evidence verification classification sourcing_note body
- Update 2026-10-05T0404Z-intel
Sophos X-Ops reports a campaign it tracks as STAC4924, active since at least March and closely aligned with this chain, with 19 pairings of a legitimate executable and a malicious DLL rather than one, a loader that stores shellcode as English words, C2 addresses read from a profile on a legitimate community platform, and a first phase of trojanized Teams installers before the TerminalFix lures. Sophos says its observations support BlueVoyant's attribution to the group linked to Vice Society and Rhysida, and that it has seen no encryption.
Changed: updated_at summary entities techniques sources evidence sourcing_note body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.