TerminalFix campaign deploys a reverse tunnel through multistage intrusion

1. Executive summary

Microsoft reports a TerminalFix campaign using compromised websites and fake Cloudflare CAPTCHA prompts to induce users to execute clipboard-delivered PowerShell. The resulting chain uses DLL sideloading, steganographic payload delivery, dual persistence, Active Directory reconnaissance and a Python implant providing arbitrary TCP proxy access through an encrypted WebSocket tunnel. A confirmed match should receive P1 incident response because the affected endpoint can act as an internal network pivot; however, Microsoft did not observe privilege escalation, lateral movement, data exfiltration or ransomware deployment in the analysed chain, and no evidence establishes specific targeting of EMEA financial services. No CVE is implicated, so CVSS severity and CISA KEV status are not applicable; the TerminalFix-specific chain, attribution position and IOC set are single-sourced to Microsoft and should be verified before enforcement.

2. Regulatory framing

The supplied reporting does not establish operational disruption, affected customer services or other facts sufficient to determine a reporting obligation under DORA, NIS2 or UK NIS 2018.

3. Technical analysis & attack chain

The following steps were observed by Microsoft but are not independently corroborated in the supplied material:

1. User-assisted initial access: A compromised website displays a fake Cloudflare Turnstile overlay. Interaction copies a malicious command to the clipboard and instructs the victim to paste it into Windows Terminal or PowerShell.
2. PowerShell delivery: The command displays Cloudflare-themed status messages while downloading verify_pkg.zip, extracting it under C:\ProgramData and silently launching a batch file. Microsoft hunting logic identifies 1.bat in this execution sequence.
3. DLL sideloading: The batch file launches the legitimate, signed LockScreenContentServer.exe. Its static dependency on dui70.dll causes the Windows loader to select a malicious co-located DLL from the application directory.
4. Steganographic staging: PowerShell launched by the DLL retrieves three PNG files through HTTP POST requests. Pixel RGBA values encode an executable and two halves of a DLL, which are reconstructed and written to disk.
5. Persistence: The chain creates an HKCU\…\Run entry and a scheduled task using the masquerading label LockScreenContentServer_MuODG5yBM. The task re-executes the payload every 60 minutes, and the malware directory receives hidden and system attributes.
6. Discovery: The malware collects host and domain information, enumerates domain trusts, domain administrators, AD users and computers, harvests user-description fields and pings server names associated with domain-controller, database, backup, gateway and mail roles.
7. Asynchronous command execution: A persistent PowerShell loop watches a local text file, passes new content to Invoke-Expression and writes command output to a separate file.
8. Reverse tunnel: The attacker installs an official embeddable Python 3.14.5 runtime and launches client.py through pythonw.exe. The implant connects to gitnow[.]dev:443, upgrades to WebSocket at /tunnel and proxies arbitrary TCP connections into the victim network.

Initial access and execution

No exploited product vulnerability or CVE is reported. Initial access depends on social engineering and the user manually executing a clipboard-supplied PowerShell command. The method differs from conventional ClickFix lures by directing the user to Windows Terminal or PowerShell rather than the Windows Run dialog, allowing more complex or multi-line scripts to execute.

The supplied Malwarebytes research independently corroborates the broader use of fake Google or Cloudflare verification pages and user-executed PowerShell in ClickFix activity. It does not corroborate this TerminalFix implant, infrastructure or attack chain.

DLL sideloading and in-memory staging

The initial ZIP has SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f and contains:

Because the application directory is searched before the system DLL location, the signed executable loads the attacker-controlled dui70.dll. The DLL contains an obfuscated resource which it decodes in memory before transferring execution, avoiding creation of the decoded stage as a separate file.

Steganographic payload handling

The PowerShell stage uses a failover arrangement across bestsocialmedianewspapper[.]com and offlineupdater[.]com. Its image-extraction function reads RGBA pixel channels; the first eight decoded bytes specify payload length as a 64-bit integer and the remaining bytes contain file data.

The first PNG supplies an executable. The second and third supply separate DLL fragments which are concatenated on disk. The PNG source files are then deleted. This makes individual network objects appear to be images and prevents either DLL fragment from containing the complete payload in transit.

Persistence and discovery

The exact Run-key path, value data, scheduled-task action and malware directory are not published. Responders should not infer them beyond the reported HKCU\…\Run location, 60-minute task interval and LockScreenContentServer_MuODG5yBM label.

Observed discovery uses nltest, net group, ADSI searches and ICMP pinging. System-information collection includes English, Spanish and German locale handling. The published material does not provide the complete command lines or targeted hostnames.

Command-and-control capability

The file-watch loop provides a local asynchronous command channel: content written to its watch file is executed using Invoke-Expression, and results are placed in an output file retrievable through the tunnel. The filenames are not disclosed.

The reverse-tunnel deployment removes any previous implant directory, extracts its kit, downloads the official Python 3.14.5 embeddable archive using TLS 1.2 and launches the implant without a console using pythonw.exe. Reported command-line elements include client.py, --server, --uuid, cert.pem and gitnow.dev.

The implant supports:

• TLS WebSocket communication over TCP/443 to /tunnel, with certificate verification disabled through CERT_NONE.
• SOCKS5-style IPv4, IPv6 and hostname parsing for arbitrary internal TCP connections.
• Multiplexing through a custom seven-byte header containing message type, stream ID and length.
• Eight message types covering identification, connection setup, data transfer, keepalive and shutdown.
• Rotation among four Chrome, Firefox and Safari User-Agent strings.
• Remote termination through MSG_SHUTDOWN and os._exit.
• Silent execution with DEBUG = False and logging directed to standard error.

This capability can expose any service reachable from the compromised host. Microsoft did not observe the operator using it for lateral movement, privilege escalation, security-control impairment, data access, exfiltration or ransomware deployment. Defender alert names referring to pre-ransomware or ransomware attempts are detection taxonomy, not evidence that ransomware occurred in this campaign.

Microsoft does not attribute the campaign to a named actor. No actor attribution is made by Adverse Trace.

4. Mitigation & containment

P1 — within 24 hours

• Isolate any endpoint matching a published hash, the specific tunnel command line or the LockScreenContentServer.exe/dui70.dll sideloading sequence. Permit only incident-response connectivity.
• Terminate pythonw.exe or python.exe only where the process command line matches client.py, --server, --uuid, cert.pem and gitnow.dev; do not block legitimate Python execution globally.
• Quarantine exact hash matches. Preserve memory, process information, network state, scheduled tasks, the executing user’s HKCU hive and relevant C:\ProgramData files before eradication.
• Validate the single-sourced domains against internal allowlists and telemetry, then block confirmed matches at DNS, proxy, firewall and secure-web-gateway layers. TCP/443 alone is not a useful block criterion.
• Locate the reported persistence:

schtasks.exe /Query /TN "LockScreenContentServer_MuODG5yBM" /V /FO LIST
reg.exe query HKCU /f "LockScreenContentServer_MuODG5yBM" /s

• After evidence capture, remove a confirmed scheduled task:

schtasks.exe /Delete /TN "LockScreenContentServer_MuODG5yBM" /F

• Remove the corresponding Run value only after resolving its exact registry path and command. The source does not provide enough detail for a safe universal reg delete command.
• Revoke sessions and reset credentials used on a confirmed endpoint where investigation identifies credential exposure. Examine privileged and service-account use from that device.

P2 — within 72 hours

• Reimage confirmed hosts from trusted media where the in-memory DLL stage or reverse tunnel executed. Deleting only the visible ZIP or DLL does not address redundant persistence or unknown follow-on commands.
• Hunt the available endpoint, DNS, proxy and firewall retention using the queries and indicators in §§5–6.
• Review AD and endpoint telemetry for nltest, net group, ADSI enumeration, unusual LDAP queries, domain-admin lookups and server ping sweeps originating from affected hosts.
• Review east-west authentication and connections from the host, particularly to domain controllers, database, backup, mail and gateway systems.
• Check every relevant user hive: the reported Run-key persistence is under HKCU and may not appear when examining only the currently logged-on responder account.
• Confirm coverage for the Microsoft detections listed in §6 and update endpoint security intelligence.
• Apply application-control policy to prevent unsigned DLL or executable loading from user-writable locations such as campaign-created directories under C:\ProgramData, subject to testing.

Do not delete C:\ProgramData wholesale. LockScreenContentServer.exe and Python 3.14.5 are legitimate components abused by the campaign; filename or version alone is insufficient for enforcement.

P3 — within seven days

• Restrict direct workstation egress and unauthorised outbound WebSocket traffic. Require approved proxies and alert on long-lived WebSocket sessions to newly observed destinations.
• Review browser controls capable of warning on or restricting unexpected clipboard writes from untrusted sites.
• Train service-desk and high-risk users that CAPTCHA services do not require commands to be pasted into Terminal, PowerShell or the Run dialog.
• Test the supplied detections against local telemetry and baseline legitimate LockScreenContentServer.exe, dui70.dll and Python activity.
• Conduct retrospective review across the available retention period for affected users, related endpoints and internal systems contacted from confirmed hosts.

There is no vulnerable product version or vendor patch associated with this campaign. Remediation consists of containment, persistence removal or reimaging, credential scoping and control changes.

5. Indicators of compromise

All indicators below are reported by Microsoft and are not independently corroborated in the supplied material: single-sourced; verify before enforcement.

sha256  18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f
sha256  b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a
sha256  ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07
sha256  026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab
sha256  032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22
sha256  df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf
sha256  eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0
sha256  5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8
sha256  9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24
sha256  342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e
sha256  ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d
domain  gitnow[.]dev
domain  bestsocialmedianewspapper[.]com
domain  offlineupdater[.]com
url  hxxps://linked-log[.]com/

6. Detection

The following YARA rule targets strings reported as present in the Python reverse-tunnel implementation:

rule AT_TerminalFix_Python_Reverse_Tunnel
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-29"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/"
        description = "Detects reported TerminalFix Python reverse-tunnel implementation strings"

    strings:
        $py_endpoint = "/tunnel" ascii
        $py_shutdown = "MSG_SHUTDOWN" ascii
        $py_cert = "CERT_NONE" ascii
        $py_exit = "os._exit" ascii
        $py_debug = "DEBUG = False" ascii

    condition:
        4 of ($py_*)
}

title: TerminalFix Python Reverse Tunnel Execution
status: experimental
description: Detects the reported TerminalFix client.py invocation with its C2 and command-line parameters.
author: Adverse Trace
date: 2026-08-29
references:

  - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:

      - 'pythonw.exe'
      - 'python.exe'
  selection_command:
    CommandLine|contains|all:

      - 'client.py'
      - '--server'
      - '--uuid'
      - 'cert.pem'
      - 'gitnow.dev'
  condition: selection_image and selection_command
falsepositives:

  - Authorised testing reproducing the published command line
level: high

Microsoft-provided Defender XDR hunting queries:

DeviceProcessEvents

| where InitiatingProcessFileName =~ "powershell.exe"
| where FileName =~ "cmd.exe"
    and ProcessCommandLine has_all (@"\ProgramData\", "1.bat", "LockScreenContentServer.exe")

DeviceImageLoadEvents

| where InitiatingProcessFileName =~ "LockScreenContentServer.exe"
| where FileName =~ "dui70.dll"
| extend path = tostring(parse_path(FolderPath).DirectoryPath)
| where path =~ InitiatingProcessFolderPath
| where not(path has_any (
    @"\Windows\System32",
    @"\Windows\SysWOW64",
    @"\winsxs\",
    @"\program files",
    @"\Windows Defender\",
    @"\Microsoft Security Client\",
    @"\Program Files\Windows",
    @"\Program Files\Microsoft",
    @"\ProgramData\Microsoft\",
    @"\Microsoft\Windows",
    @"\amd64_windows-defender-service",
    @"\Microsoft Defender for Endpoint\"
))

DeviceProcessEvents

| where FileName in~ ("pythonw.exe", "python.exe")
| where ProcessCommandLine has_all ("client.py", "--server", "--uuid", "cert.pem", "gitnow.dev")

DeviceNetworkEvents

| where RemoteUrl has_any (
    "gitnow.dev",
    "bestsocialmedianewspapper.com",
    "offlineupdater.com"
)

| project Timestamp, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName

Reported Microsoft Defender Antivirus detections include:

• Trojan:Win32/ClickFix.*
• Trojan:Win32/TermFix.*
• Trojan:Win32/Posilod.*
• Trojan:Win64/DLLHijack.DAB!MTB
• Trojan:Python/Indigo.SA

Relevant Defender for Endpoint alerts include unexpected DLL loading, anomalous ASEP registry activity, suspicious scheduled tasks, suspicious LDAP or AD enumeration, anomalous account lookups and potentially malicious proxy or tunnelling activity.

7. Sources

• Microsoft Threat Intelligence, “TerminalFix campaign deploys a reverse tunnel through multistage intrusion,” 29 August 2026: https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• Malwarebytes Labs, “Fake Google and Cloudflare verification pages spread multiple malware families,” July 2026: https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families

8. Adverse Trace position

No formal CVE, CVSS severity or CISA KEV exploitation state applies because this is a social-engineering-led intrusion campaign rather than exploitation of a disclosed vulnerability. Adverse Trace assesses a confirmed match as a high operational priority because the implant supplies persistent arbitrary-TCP access into the victim network, but the available evidence does not establish lateral movement, privilege escalation, exfiltration, ransomware, EMEA financial-sector targeting or a named threat actor. TerminalFix-specific technical claims and IOCs remain single-sourced to Microsoft; verify before enforcement, particularly for domain-wide blocking and legitimate-binary controls. Adverse Trace will monitor for independent infrastructure corroboration, downstream activity, victimology and attributable actor reporting.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.