Security1 distinct publisher2 min readPublished
Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The Run dialog constrained the attacker as much as the victim: one line, pasted blind, no scrollback. That ceiling is why the usual ClickFix outcome has been a single infostealer [4]. Windows Terminal and PowerShell remove it, and Microsoft Threat Intelligence describes that as the point of the change, since complex multi-line scripts execute successfully more often when the window can take them [3].
Nothing in the chain exploits a software flaw. The user pastes the command, and that paste is the execution primitive [17]. Everything after it is built to look ordinary. The ZIP extracts to C:\ProgramData and a batch file starts LockScreenContentServer.exe, a signed legitimate binary, which loads the co-located malicious dui70.dll on its own [5][6]. Signature checking passes it. The anomaly is the directory it runs from. The second-stage fetches are PNG downloads from attacker domains, with executables and DLL fragments carried in pixel data and reassembled on disk [7], so content inspection keyed to executable payloads sees images.
Persistence is doubled: an HKCU Run key plus a scheduled task that re-executes the loader every 60 minutes [8]. At that interval the loader fires 24 times a day and 168 times a week [15]. A responder who kills the process and clears one of the two persistence points has an hour, at most, before the host comes back.
The reconnaissance is what turns this from a malware problem into an access problem. The sideloaded stage enumerates domain trusts, domain admin group membership, Active Directory computers and users, harvests AD user description fields, and pings selected servers, collecting system information in both English and Spanish locales [9]. A persistent PowerShell loop then watches a text file for further commands [13]. The chain ends with a Python reverse-tunnel implant that carries arbitrary TCP traffic back to attacker infrastructure over an encrypted WebSocket [10], a network-level proxy that operates inside the domain and gives the attacker a standing route back in.
Microsoft is careful about the boundary of what it saw. It states it did not observe the downstream hands-on-keyboard phase in the analyzed chain, and its description of privilege escalation, control tampering, exfiltration and ransomware is what typically follows this level of access rather than activity in this intrusion [11]. Its guidance is to treat affected devices as potential network pivot points and hunt for lateral movement and credential exposure [12]. The post carries indicators of compromise, detection details and hunting guidance [16]. It leaves out an observation window, a count of affected organizations, and a named actor [14].
Ranked by verification strength, evidence, and original report placement.
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries.
The campaign uses compromised websites that display a fake Cloudflare Turnstile CAPTCHA verification overlay instructing the user to copy and paste a malicious PowerShell 'verification' command.
Traditional ClickFix campaigns direct victims to the Windows Run dialog; TerminalFix directs users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully.
Unlike earlier ClickFix variants that typically deliver a single infostealer, this TerminalFix campaign deploys a multi-stage chain combining DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant.
The pasted PowerShell downloads a ZIP archive from attacker infrastructure containing the legitimate signed binary LockScreenContentServer.exe and a malicious DLL, dui70.dll, extracts it to C:\ProgramData, and silently launches a batch file.
The batch file executes LockScreenContentServer.exe, a signed legitimate binary, which automatically loads the co-located malicious dui70.dll.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 28, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Sophos: Fake AI Installers Drove 30 of 38 AI-Linked MDR Cases, With Claude the Favourite Costume1 distinct publisher
security
Bring Your Own Runtime: Sophos MDR maps a repeatable Deno-based intrusion chain1 distinct publisher
invest
Check Point finds 2,000 hacked WordPress sites doing the hosting for a crypto-stealing toolkit2 distinct publishers
security
ClickFix operators install the signed Deno runtime to run their remote JavaScript1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Granular, first-party, unverified
Every artifact in this story — the ZIP dropped to C:\ProgramData, the signed loader, the pixel-data payloads, the hourly task, the tunnel to gitnow[.]dev:443 — comes from one place: Microsoft's telemetry, described by Microsoft. The detail is specific enough to hunt on tonight, which is a real form of strength. But no second party has checked any of it, and the three things that would let a reader size the threat are simply absent from the text: no first-seen date, no victim count, no actor name.
Live in the wild, size unstated
Microsoft says it watched this run against real organizations in more than one industry, and the Spanish-locale branch in the recon commands hints the operators expect a mixed-language estate — so this is not a lab curiosity. Beyond that the reporting gives nothing quantitative: no number of victims, no sectors named, no timeframe. Confirmed-active but unmeasured is the honest reading, and it is why the score sits low rather than absent.
Slightly ahead of what was seen
Microsoft calls this sophisticated and a serious threat to enterprise environments, then concedes in the same passage that it never saw the privilege escalation, the disabled defences, the exfiltration or the ransomware — those belong to a hands-on phase it describes but did not witness. That caveat is unusually clean and pulls the gap most of the way closed. What is left is the framing around it: the scariest consequences are the unobserved ones, and with no scope figures anywhere, a reader is invited to assume prevalence the reporting never claims.
Researcher and product owner are the same party
Read the chain and notice who owns each piece: the terminal the victim pastes into, the signed binary that sideloads, the registry hive holding persistence, and the detection guidance closing the post all belong to Microsoft. Publishing this is a genuine defender service and also a demonstration of its own security telemetry. The other interested party is voiceless — the lure wears Cloudflare's Turnstile branding, and Cloudflare gets no say in how its interface is being used as bait.
Trust the mechanics, not the magnitude
Split the story in two and the confidence splits with it. The mechanics — clipboard lure, sideload, steganography, hourly task, tunnel — are described by the party with the best possible visibility and in enough detail to act on, so they hold up well. The magnitude does not exist in the record at all: one publisher, no corroboration, no dates, no counts, no attribution. Act on the indicators; hold the significance loosely until someone else reports the same chain.