Microsoft Threat Intelligence identified the TerminalFix campaign, a variant of ClickFix techniques, targeting organizations across multiple sectors through compromised websites that display a fake Cloudflare Turnstile verification window. Instead of merely running a single information-stealing tool, as occurs in many earlier ClickFix campaigns, the page prompts the user to copy and paste a command into Windows Terminal or PowerShell.
The pasted command runs a PowerShell script disguised as a Cloudflare verification process and downloads a ZIP archive to C:\ProgramData before silently running a batch file. The archive contains the legitimate, signed executable LockScreenContentServer.exe and the malicious library dui70.dll. The attacker exploits the executable's dependence on the library to load the malicious version from the same directory, a technique known as DLL sideloading, allowing execution to begin through an apparently trusted process.
A Multistage Chain That Goes Beyond the Initial Infection Stage
After sideloading, the library extracts an encrypted payload from its own resource section, then runs PowerShell to download three PNG images from attacker-controlled domains. The images conceal executable files and portions of a DLL inside pixel data using steganography, before reassembling them on disk and deleting the original images to reduce forensic traces.
The malware establishes two independent persistence mechanisms: a Registry Run key and a scheduled task that relaunches LockScreenContentServer.exe every 60 minutes. Payload directories are also concealed using hidden-file and system-file attributes. It then gathers information about the device and environment, including domain trust relationships, members of the Domain Admins group, and Active Directory accounts and hosts, in addition to pinging servers that may represent domain controllers, databases, backup servers, gateways, and mail servers.
The Reverse Tunnel Is the Most Dangerous Element of the Campaign
The most significant capability Microsoft identified is the deployment of a Python-written reverse-tunneling tool. The attacker obtains the embeddable Python 3.14.5 environment from the official python.org distribution, while the malicious functionality resides in the client.py file. The tool is launched through pythonw.exe without a visible window, then connects to the attacker's infrastructure over TLS on port 443 and upgrades the connection to a WebSocket channel.
This channel enables arbitrary TCP connections to be relayed using the SOCKS5 protocol, turning the compromised device into a transit point that can be used to access other systems visible from the organization's network. The campaign also runs a PowerShell loop that monitors a text file, executes commands written to it, and saves the results in another file that can be read through the tunnel.
What Does This Mean for Defense Teams?
Microsoft does not claim to have observed privilege escalation, data theft, or ransomware deployment in the analyzed chain; however, it warns that the presence of the reverse tunnel means the affected device should be treated as a potential pivot point within the network. Accordingly, lateral movement and potential credential exposure should be investigated, with priority given to changing credentials that the device could access, including domain administrator accounts if the device was joined to the domain.
Microsoft recommends restricting PowerShell, Windows Terminal, and the Run dialog for standard users; enabling PowerShell Script Block Logging; monitoring the execution of LockScreenContentServer.exe from nonstandard paths; and training users not to paste commands requested by CAPTCHA pages. The company also included Advanced Hunting queries to detect sideloading, payload extraction from images, execution of client.py, and connections to domains associated with the campaign, along with MITRE ATT&CK rules covering initial access, execution, persistence, discovery, and command and control.