The TerminalFix attack is a ClickFix-style social engineering campaign that tricks users into pasting malicious PowerShell into Windows Terminal. Reported by Microsoft on August 28, 2026, it uses fake Cloudflare CAPTCHA overlays, downloads a ZIP, abuses DLL sideloading, hides payload data in PNG pixels, and ends with a Python reverse-tunnel implant. Treat any infected host as a possible network pivot, not just a cleaned-up workstation.
What makes the TerminalFix attack different?
Most ClickFix lures push the victim toward the Windows Run dialog. The TerminalFix attack changes the stage: it tells the user to open Windows Terminal or PowerShell and paste a command there, which is a small social-engineering tweak with a large operational payoff.
Windows Terminal is better suited to complex, multi-line PowerShell than the Run box. Long commands, encoded payloads, download cradles, and execution chains are less likely to break. That’s the quiet trick here. It doesn’t need a browser exploit if the user becomes the installer.
Microsoft Security Research named TerminalFix on August 28, 2026, and said it had seen the campaign targeting organizations across multiple industries. BleepingComputer, OraSec, and Malwarebytes followed with summaries between August 31 and September 1, 2026, but the reliable technical center of gravity remains Microsoft’s primary report.
The useful mental model is simple: ClickFix gets the click, TerminalFix gets a terminal. If your awareness training only says “don’t paste commands into Run,” you’re behind the lure.
The infection chain, step by step
Compromised websites are the front door. Users land on pages that display fake Cloudflare CAPTCHA or Turnstile-style overlays, a familiar enough visual pattern that many people comply before thinking.
The page instructs the user to copy and run a PowerShell command. Once executed, the observed chain downloads a ZIP archive that contains a legitimate signed Microsoft binary, LockScreenContentServer.exe, and a malicious DLL named dui70.dll. Microsoft reported the ZIP SHA-256 as 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f in 2026.
- Initial lure: compromised site with a fake Cloudflare CAPTCHA or Turnstile-style overlay.
- User action: copy a command and execute it in Windows Terminal or PowerShell.
- Download: ZIP archive with signed
LockScreenContentServer.exeand maliciousdui70.dll. - Execution: DLL sideloading through the legitimate executable.
- Payload staging: data hidden in PNG pixel data is reconstructed on disk.
- Persistence: Registry Run keys and scheduled tasks keep the malware running.
- Access: a Python-based reverse tunnel gives attackers SOCKS5-style TCP proxy capability.
There’s a pitfall many teams miss: blocking obvious unsigned malware isn’t enough when a signed, legitimate executable becomes the loader. DLL search order abuse remains boring, old, and effective.
DLL sideloading, steganography, and persistence
The TerminalFix attack uses DLL sideloading by pairing LockScreenContentServer.exe with a malicious dui70.dll. The binary is legitimate and signed; the DLL is not the file defenders want it to be. Microsoft said the DLL masqueraded as “Windows DirectUI Engine” and used a forged future timestamp of 2104.
Microsoft also reported an observed extraction path of C:ProgramDataf47f2a8c21c9df4e. That exact path may not appear in every environment, but it’s a strong hunting clue for the analyzed chain. Random-looking ProgramData directories deserve attention when they contain Windows-looking binaries outside normal component locations.
Payload data is hidden in PNG image pixel data and rebuilt on disk. Steganography sounds exotic, but here it’s mostly a packaging decision: hide bytes in a file format defenders may treat as harmless. Malwarebytes argued on September 1, 2026, that the distinctive feature isn’t steganography itself; it’s the payload goal, namely domain-aware reconnaissance followed by a custom multiplexed reverse TCP tunnel.
Persistence is established through Registry Run keys and scheduled tasks. In Microsoft’s observed sample, the scheduled task re-executed LockScreenContentServer.exe every 60 minutes. Do the math: in a 24-hour containment delay, that’s up to 24 fresh relaunch opportunities, plus whatever interactive access the tunnel enables during that window.
TerminalFix attack indicators and behaviors compared
Defenders need both static indicators and behavior-based detections. Static indicators are fast, but brittle. Behavior survives repacking, changed domains, renamed folders, and lightly modified commands.
If you already centralize Windows logs, process telemetry, proxy events, and EDR alerts, connect this campaign to broader detection engineering rather than treating it as a one-off IOC chase. A mature SIEM threat detection program should correlate suspicious terminal launches, archive extraction, DLL loading, persistence changes, and outbound tunnel traffic into one story.
| Signal reported in 2026 | What to look for | Why it matters |
|---|---|---|
| Fake CAPTCHA lure | Users reporting Cloudflare-style verification that asks them to run commands | Legitimate CAPTCHA never requires PowerShell execution |
| Windows Terminal or PowerShell execution | Browser-adjacent copy-paste into terminal, encoded commands, remote downloads | This is the key ClickFix-to-TerminalFix shift |
| ZIP archive SHA-256 | 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f |
High-confidence indicator from Microsoft’s August 28, 2026 report |
| Extraction path | C:ProgramDataf47f2a8c21c9df4e |
Useful for endpoint sweeps in the observed chain |
| DLL sideloading | LockScreenContentServer.exe loading local dui70.dll |
Legitimate signed binary helps malicious code blend in |
| Scheduled task interval | Task relaunching every 60 minutes | Persistence with repeated execution attempts |
| Reverse tunnel | Outbound TLS/WebSocket traffic over port 443; Microsoft reported gitnow[.]dev:443 |
Turns the host into a proxy point inside your network |
One edge case matters in investigations: Microsoft said it did not observe downstream hands-on-keyboard actions in the analyzed chain. That doesn’t mean the host was safe. It means the observed intrusion may have stopped at access preparation, and preparation is already a serious incident when the payload offers proxy access.
Why the reverse tunnel changes the risk
The end payload is a Python-based implant that uses outbound TLS/WebSocket traffic over port 443. Microsoft reported that it contacted gitnow[.]dev:443 and disabled certificate verification with CERT_NONE. The practical result is SOCKS5-style TCP proxy access through the compromised host.
Port 443 is the camouflage. Many environments allow outbound HTTPS broadly, and a tunnel over WebSocket can look less strange than a raw reverse shell. Honestly, blocking one domain after the fact only makes sense as a short-term containment step; the stronger control is egress filtering tied to identity, destination reputation, TLS inspection policy where lawful, and alerting on unusual long-lived connections.
Once that tunnel exists, the endpoint is no longer just a victim machine. It can become a foothold for probing domain controllers, databases, backup servers, gateways, and mail systems. Microsoft and secondary reporting both said affected hosts should be treated as possible network pivot points and investigated for lateral movement and credential exposure.
The campaign’s reconnaissance is domain-aware. Reported scripts collected system information, enumerated Active Directory, discovered domain trusts, looked for domain admins, and probed infrastructure. Microsoft also said the reconnaissance scripts included English, Spanish, and German locale handling, which suggests the operators expected to land in varied enterprise environments rather than a narrow consumer target set.
How defenders should respond
Start with containment, not cosmetic cleanup. If the TerminalFix attack landed, isolate the host, preserve volatile evidence where your process allows, and assume credentials present on the machine may have been exposed.
Endpoint teams should hunt for the reported archive hash, the ProgramData path, suspicious LockScreenContentServer.exe executions, local dui70.dll loads, Run key modifications, and scheduled tasks created near the time of the user’s browser activity. Network teams should review outbound 443 traffic for long-lived WebSocket or TLS sessions to unusual destinations, including the Microsoft-reported gitnow[.]dev indicator.
Identity review is just as important as malware removal. Because the implant’s goal is network access, check for authentication attempts, Kerberos activity, LDAP queries, domain trust enumeration, and access to backup or mail infrastructure after the suspected execution time. Behavior analytics for account takeovers can help here because the suspicious part may be a normal account touching abnormal systems.
Awareness training needs a sharper script. Tell users that no legitimate CAPTCHA, Cloudflare verification, or browser check asks them to open Windows Terminal, PowerShell, or Command Prompt and paste a command. Short. Specific. Memorable.
Security architecture also matters. The TerminalFix attack is a useful argument for verifying trust before network access, especially for workstations that can reach sensitive internal services by default. Pair that with realistic exercises; automated red-team testing can validate whether your controls catch terminal-based social engineering, sideloaded DLLs, and outbound tunnels before a real campaign does.
Cloud-hosted web properties deserve attention too. Since the lure begins on compromised sites, web owners should keep CMS software, plugins, edge rules, and deployment credentials under active review. The same operational discipline behind reducing cloud misconfiguration exposure applies to preventing your site from becoming someone else’s delivery page.
TerminalFix attack FAQ
Is TerminalFix the same as ClickFix?
No. The TerminalFix attack is a ClickFix variant, but it pushes users toward Windows Terminal or PowerShell instead of the Windows Run dialog. That shift makes more complex command execution easier.
Does fake Cloudflare CAPTCHA mean Cloudflare was hacked?
No evidence in the 2026 reporting says Cloudflare was compromised. The attackers imitate Cloudflare CAPTCHA or Turnstile-style overlays on compromised websites to borrow trust from a familiar interface.
What is the main payload in TerminalFix?
The reported final payload is a Python-based reverse-tunnel implant using outbound TLS/WebSocket traffic over port 443. It gives attackers SOCKS5-style TCP proxy access through the infected host.
What should I do if a user pasted the command?
Isolate the device, collect evidence, hunt for the reported ZIP hash, DLL sideloading, persistence keys and scheduled tasks, then review identity and network logs for lateral movement. Treat the host as a possible pivot point.
Did Microsoft observe hands-on-keyboard activity?
Microsoft said on August 28, 2026, that it did not observe downstream hands-on-keyboard actions in the analyzed chain. That lowers one part of the evidence, but it doesn’t remove the risk created by a working reverse tunnel.
EN 
FR 
ES