TerminalFix reverse-tunnel intrusion

Summary

Microsoft Threat Intelligence published this analysis on 28 August 2026 and names the technique TerminalFix: a ClickFix variant that sends the victim to Windows Terminal or PowerShell rather than the Run dialog, where a long multi-line command is likelier to run intact. The lure sits on hacked websites as a counterfeit Cloudflare Turnstile check. While it prints reassuring Cloudflare-styled status lines, the pasted command pulls a ZIP into ProgramData, and inside it a signed Windows lock-screen binary loads a planted dui70.dll. That DLL retrieves PNG images whose pixel data hides a further executable and DLL, adds a Run key and an hourly scheduled task, and enumerates the Active Directory domain. The last stage is a Python implant that relays arbitrary TCP connections over a WebSocket. Microsoft says it did not see what the operators went on to do with that access.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

15 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.