Visitors to a compromised website are being shown a Cloudflare check they have seen a thousand times: the logo, the "Verify you are human" box, the spinner. It is a forgery painted over the real page. Interacting with it silently copies a PowerShell command into the visitor's clipboard, and the overlay then walks them through opening Windows Terminal and pasting it in. The script prints a reassuring green confirmation back at them, "I am not a robot", stamped with a Cloudflare ID of f47f2a8c21c9df4e.
By the time that line appears, an archive is already unpacking on the disk.
Microsoft Threat Intelligence published its analysis of the campaign on 28 August, credited to Microsoft security researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan. They call it TerminalFix and place it in the ClickFix family, the social engineering trick that gets a person to run the attacker's command on their own machine. What makes this one worth reading is everything that comes after the paste. Earlier ClickFix variants typically deliver a single infostealer and finish there, which is the shape we described in recent loader campaigns pushing fake game downloads. This one builds a quiet road into the corporate network sitting behind the machine, and keeps the keys to it.
Why the terminal and not the Run box
Traditional ClickFix lures point victims at the Windows Run dialog, the little box that opens with Win and R. TerminalFix sends them to Windows Terminal or a PowerShell console instead, which Microsoft says increases the likelihood that complex, multi-line scripts execute successfully. Our own reading is that the bigger paste target is what lets a chain this long survive the one step the attacker does not control, the moment a person pastes and presses enter.
The pasted command clears the screen, prints a fake "Starting Cloudflare verification" message in cyan, downloads a ZIP archive from attacker infrastructure using a custom User-Agent header, extracts it to C:\ProgramData\f47f2a8c21c9df4e, and quietly launches a batch file. That folder is worth writing down: its name is the same string the script prints back to the victim as a Cloudflare ID, which makes it a literal path to hunt for. Then comes the green line the victim actually reads.
Borrowing a signed Windows process
Inside the archive are two files. One is LockScreenContentServer.exe, a legitimate, signed Windows binary. The other is dui70.dll, a counterfeit of the Windows DirectUI Engine library that the real executable expects to load. It is unsigned and carries a forged compile timestamp dated to the year 2104.
Windows resolves a program's own folder before it looks in System32, so when the batch file runs the signed executable from C:\ProgramData, the planted DLL wins. This is DLL sideloading, and its value to an attacker is reputational: execution starts inside a trusted, signed Microsoft process, which defeats controls that decide what to allow based on which program is running. The malicious DLL keeps a heavily obfuscated payload in its resource section, decodes it entirely in memory on load, and hands over execution without ever writing the decoded stage to disk.
Three PNGs that are not pictures
The second stage arrives as images. A PowerShell script downloads three PNG files from attacker-controlled domains, with a failover mechanism across two of them, and reads the payload out of the pixels. The extraction routine walks each pixel's red, green, blue and alpha channels; the first eight bytes encode the payload length as a 64-bit integer and the rest is the file. The first image yields an executable. The second and third each carry one half of a DLL, which the script concatenates back together. The source images are deleted afterwards to thin out the forensic trail.
Steganography here is not showmanship. A PNG travelling over HTTPS does not look like an executable to content inspection, and splitting the DLL across two images means no single download is a complete artifact.
The malware wants to know who runs the domain
Persistence is doubled up: a registry Run key under HKCU and a scheduled task that re-launches the payload every 60 minutes, both registered under a name chosen to blend in with the Lock Screen component being abused. The payload directory is then hidden with system and hidden file attributes.
What follows reads like a pre-purchase inspection. The malware enumerates domain trusts, pulls the membership of the domain admins group, runs directory searches for computers and users, harvests Active Directory user description fields, and ping sweeps a list of named servers whose names correspond to domain controllers, databases, backup systems, gateways and mail. The system information collection ships with English, Spanish and German locale variants, which suggests an operator expecting to land on machines configured in more than one language. Microsoft reads this as either a hands-on operator or an automated script deciding whether this host is worth the trouble.
A PowerShell loop then watches a text file, executes whatever appears in it, and writes the results to a second file. It is a crude command channel, and it works.
The attacker brings their own Python
The capability that matters most is the last one. The chain downloads an unmodified, signed embeddable Python runtime straight from the official python.org distribution, unpacks it, and launches a custom script called client.py through pythonw.exe, the interpreter that runs without a console window. All of the malice lives in that one script.
client.py dials outbound on TCP 443, negotiates TLS, upgrades the session to a WebSocket, and then relays arbitrary TCP connections on the operator's behalf. Certificate verification is disabled outright. It parses addresses the way a SOCKS5 proxy does, so the server on the other end can tell the implant to connect to any host and port the victim machine can see, and it multiplexes many of those connections over the single WebSocket using a compact seven byte header. It rotates through four ordinary browser User-Agent strings. The operator can also kill it remotely. On the wire it looks like one long encrypted web session to a single destination, which is protocol tunnelling doing exactly what it is supposed to do for the attacker.
Put that next to the reconnaissance and the picture is clear. The compromised desktop is not the objective. It is a doorway held open into everything the desktop can reach.
A Python build that python.org retired in June
One detail in the deployment script is worth pulling on. The kit does not use whatever Python is present; it fetches a specific version, the embeddable 3.14.5 archive. Python's own download archive records 3.14.5 as a 10 May 2026 release, superseded by 3.14.6 on 10 June and by 3.14.7 on 5 August 2026. The operator's tooling is therefore pinned to a build that upstream had already replaced twice before this campaign was documented.
Here is what that does and does not establish. It is consistent with a tunnelling kit assembled some months ago and reused, rather than something written for this intrusion, and it is a useful hunting signal, because an embeddable Python runtime pinned to one older point release is a narrow and unusual thing to find on a corporate desktop. It is not evidence of who is behind the campaign. Microsoft attributes TerminalFix to no named actor, and version pinning is just as easily an installer written once and never revisited.
Hunt for a lock screen binary in the wrong folder
Microsoft's guidance leads with the mechanics of the lure and the sideload. Alert on LockScreenContentServer.exe running from anywhere other than C:\Windows\SystemApps, which is the cheapest high-fidelity signal in this whole chain. Restrict PowerShell for standard users through AppLocker or App Control, enforce Constrained Language Mode where it is workable, and turn on script block logging so obfuscated commands leave a record. Windows Terminal can be configured to warn users when the text they are about to paste spans multiple lines, which speaks directly to the trick this campaign turns on. Train people to distrust any page that asks them to copy something into a terminal, because a real CAPTCHA does not ask you to run a command.
If indicators do turn up, treat the host as a network pivot rather than a cleanup job. Rotate every credential reachable from that machine, domain admin accounts included if it was domain joined, and hunt for lateral movement outward from it.
Indicators
Defanged, as published by Microsoft. Command and control: gitnow[.]dev on port 443. Payload image hosting and failover: bestsocialmedianewspapper[.]com and offlineupdater[.]com. Compromised site observed serving the lure: hxxps://linked-log[.]com/. The initial ZIP archive is SHA-256 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f, and the tunnel implant client.py is b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a. Microsoft lists nine further hashes for variants of the malicious dui70.dll.
Microsoft says it did not observe the hands-on-keyboard phase that usually follows this kind of access. That is an honest limit on the report, and it is also the point. The chain described here ends at the moment an intruder acquires a reliable, encrypted route into an internal network through a machine somebody thought they were unlocking a website with. What happens next is a decision the operator has not made yet.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.