Loading today’s stories
Build1 distinct publisher3 min readPublished
The chain Microsoft describes starts with a fake Cloudflare check on a compromised page and ends in a WebSocket tunnel into the LAN. Every gate that stops it sits on the endpoint or the egress path.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
The source lists its own preconditions, and that list is the control plan. The chain needs the user to run the pasted command, the endpoint to complete the downloads, application control to permit the side-load, and the WebSocket to gitnow.dev:443 to be allowed [11]. Any one of those four failing ends the intrusion at that step.
Count the retrievals the pasted one-liner has to finish: one ZIP, three PNG images carrying the executable and DLL fragments, and a Python runtime [2][4][11]. Five fetches after the paste [1]. That is five chances for a proxy or DNS control to say no, and the reason the source's detection list leans on PNG POST requests rather than on the initial script [15].
The side-load is the part worth studying. LockScreenContentServer.exe is legitimate; the dui70.dll sitting next to it is not [3]. So the detection the source offers is positional rather than reputational: that binary executing from a non-standard path, with an unknown DLL in the same folder [10]. Signature and reputation checks on the loading process return clean by construction. Your rule has to be about where the file is, not what it is.
Persistence is a Run key plus a scheduled task on a 60-minute interval, with the folder hidden by attrib +h +s [5][15]. Sixty minutes is 24 relaunch attempts a day [2]. Miss one of the two persistence artefacts during cleanup and the tunnel comes back within the hour.
The email gateway does not appear anywhere in this chain, which is awkward for the budget line it usually defends. The summary places the entry point on compromised websites and notes that public information does not specify whether email was involved at all [9]. The only pre-execution control it names is the user declining a CAPTCHA that asks them to paste commands into a terminal [10].
On the endpoint side, Script Block Logging is a logging-volume decision. Constrained Language Mode is the one that gets argued about at review, and in my context I would not push it to admin workstations without first inventorying what our own scripts actually call. That cost lands on whoever owns the automation, not on the security team that requested it.
Treat the indicators as two tiers with different shelf lives. The domains, gitnow.dev, bestsocialmedianewspapper.com and offlineupdater.com, are cheap for an operator to rotate [8]. The behaviour the source describes as pivot activity, one TLS WebSocket contacting multiple internal destinations, is much harder to change without giving up the tunnel design [16]. For that signature to fire on your network you need per-connection destination visibility from the endpoint inward, which edge flow collection generally will not give you.
One caveat on provenance. This is a secondhand summary of BleepingComputer's report on Microsoft Security Research, dated 2026-08-31 and rated High severity [13]. What is documented is persistent execution, Active Directory and internal server enumeration, and arbitrary TCP tunnelling; Microsoft's analysis did not observe credential theft or exfiltration [6][12].
Ranked by verification strength, evidence, and original report placement.
TerminalFix uses a fake Cloudflare Turnstile page on compromised websites that copies malicious PowerShell code to the visitor's clipboard.
The user pastes the copied code into the terminal, which extracts a ZIP file to C:\ProgramData and executes 1.bat.
The legitimate LockScreenContentServer.exe side-loads a malicious dui70.dll.
PowerShell restores the executable and DLL fragments from three PNG images.
The infection creates a Run key and a 60-minute scheduled task, then hides the folder.
The malware enumerates Active Directory and internal servers and sets up a file-monitoring command execution loop.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
leadership
TerminalFix sends the fake CAPTCHA command to PowerShell so multi-line payloads survive1 distinct publisher
security
ClickFix lures now paste an msiexec command that installs legitimate software to sideload a DLL1 distinct publisher
build
SynkLoader: the Teams help-desk lure now ships with a reverse proxy attached1 distinct publisher
security
Certighost turns a domain user into a Domain Controller, and the patch is only step one1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Rich detail, one relay from the source
The particulars are the kind nobody invents: dui70.dll beside a lock-screen binary in ProgramData, executable fragments tucked into three PNGs, a single WebSocket on gitnow.dev:443. But all of it reaches us through one dev.to post that credits BleepingComputer and Microsoft Security Research without quoting or linking either, and there are no hashes and no sample references to pin the artefacts down.
Seen in the wild, size unknown
Someone watched this chain run far enough to record the batch file, the persistence pair and the tunnel starting up — that is more than a proof of concept. What is entirely absent is scale: no number of affected organisations, no industry, no geography, no dwell time, and an explicit note that the theft and lateral movement stages were never observed. A defender cannot tell from this whether they are looking at a handful of intrusions or a wave.
Hedged before the reader has to ask
A High severity tag with no victim count usually signals inflation. Here the opposite happens: the write-up volunteers that the email vector is unknown and that credential theft and lateral movement were not seen, then keeps going with detection artefacts a team can query this afternoon. The framing is slightly drier than the operational value of what it contains.
Fixes that live in one vendor's console
Follow the mitigation list and it leads somewhere: Constrained Language Mode, Script Block Logging, application control over a Windows system binary. Every gate is a Microsoft platform feature, and Microsoft's researchers are the ones who named the campaign. That is not a reason to doubt the technical content, only to notice who benefits when the answer is always 'turn on the controls you already licence'. The developer reposting it has attention to gain and nothing to sell; no price or product pitch appears anywhere in this coverage.
Internally consistent, externally unchecked
Internally the account holds together — the process tree, the persistence artefacts and the network signature all describe the same intrusion, and the arithmetic on the hourly task and the five fetches follows from what is stated. Externally it stands on nothing else. One publisher, no primary document in hand, no independent responder confirming the domain. Act on the indicators, but do not treat the campaign's shape as settled.