Attackers move the ClickFix paste into Windows Terminal to land a multi-stage intrusion chain

The Run dialog constrained the attacker as much as the victim: one line, pasted blind, no scrollback. That ceiling is why the usual ClickFix outcome has been a single infostealer ^[6]. Windows Terminal and PowerShell remove it, and Microsoft Threat Intelligence describes that as the point of the change, since complex multi-line scripts execute successfully more often when the window can take them ^[4].

Nothing in the chain exploits a software flaw. The user pastes the command, and that paste is the execution primitive ^[17]. Everything after it is built to look ordinary. The ZIP extracts to C:\ProgramData and a batch file starts LockScreenContentServer.exe, a signed legitimate binary, which loads the co-located malicious dui70.dll on its own ^[7][8]. Signature checking passes it. The anomaly is the directory it runs from. The second-stage fetches are PNG downloads from attacker domains, with executables and DLL fragments carried in pixel data and reassembled on disk ^[1], so content inspection keyed to executable payloads sees images.

Persistence is doubled: an HKCU Run key plus a scheduled task that re-executes the loader every 60 minutes ^[11]. At that interval the loader fires 24 times a day and 168 times a week ^[16]. A responder who kills the process and clears one of the two persistence points has an hour, at most, before the host comes back.

The reconnaissance is what turns this from a malware problem into an access problem. The sideloaded stage enumerates domain trusts, domain admin group membership, Active Directory computers and users, harvests AD user description fields, and pings selected servers, collecting system information in both English and Spanish locales ^[9]. A persistent PowerShell loop then watches a text file for further commands ^[13]. The chain ends with a Python reverse-tunnel implant that carries arbitrary TCP traffic back to attacker infrastructure over an encrypted WebSocket ^[5], a network-level proxy that operates inside the domain and gives the attacker a standing route back in.

Microsoft is careful about the boundary of what it saw. It states it did not observe the downstream hands-on-keyboard phase in the analyzed chain, and its description of privilege escalation, control tampering, exfiltration and ransomware is what typically follows this level of access rather than activity in this intrusion ^[10]. Its guidance is to treat affected devices as potential network pivot points and hunt for lateral movement and credential exposure ^[12]. The post carries indicators of compromise, detection details and hunting guidance ^[14]. It leaves out an observation window, a count of affected organizations, and a named actor ^[15].