Full Report
Next-level ClickFix wave sets off multi-stage attack chain
Analysis Summary
# Tool/Technique: TerminalFix (Next-level ClickFix)
## Overview
TerminalFix is an evolved social engineering technique and multi-stage attack chain. It tricks users into executing malicious PowerShell commands via a phony Cloudflare CAPTCHA "verification" overlay. Unlike traditional ClickFix attacks that use the Windows Run dialog, TerminalFix targets Windows Terminal/PowerShell to facilitate the execution of complex, multi-line scripts that deploy steganographic payloads and a custom reverse tunnel for persistent network access.
## Technical Details
- **Type:** Social Engineering / Multi-stage Malware Downloader
- **Platform:** Windows (Targeting Active Directory environments)
- **Capabilities:** Steganography, DLL sideloading, AD reconnaissance, persistent reverse tunneling, and file-less command execution.
- **First Seen:** August 2026 (Reported)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (Social Engineering via fake CAPTCHA)
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1204.002 - User Execution: Malicious File
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- T1027.003 - Obfuscation: Steganography
- **TA0007 - Discovery**
- T1018 - Remote System Discovery
- T1087.002 - Account Discovery: Domain Account
- T1482 - Domain Trust Discovery
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling (Reverse WebSocket Tunnel)
- T1090 - Proxy (SOCKS-style access)
## Functionality
### Core Capabilities
- **Social Engineering:** Mimics Cloudflare verification to trick users into pasting clipboard-loaded PowerShell scripts.
- **Multi-Stage Deployment:** Uses `1.bat` to launch a signed binary (`LockScreenContentServer.exe`) which sideloads a malicious payload (`dui70.dll`).
- **Steganography:** Downloads three PNG files containing fragmented malicious components (executables and DLL halves) to evade content-type inspection.
- **Persistence:** Establishes redundancy via both `HKCU\...\Run` registry keys and hourly scheduled tasks.
### Advanced Features
- **Active Directory Reconnaissance:** Automatically enumerates domain admins, domain trusts, and searches for specific infrastructure (DC, Mail, SQL) across multiple language settings (EN, ES, DE).
- **File-Watch Loop:** A PowerShell script monitors a local `.txt` file for commands, executing them via `Invoke-Expression` to provide a flexible, low-noise backdoor.
- **Python-based Reverse Tunnel:** Deploys a stealthy WebSocket tunnel (`pythonw.exe`) to provide the attacker with SOCKS-style TCP proxy access to the internal network.
## Indicators of Compromise
- **File Names:**
- `1.bat`
- `LockScreenContentServer.exe` (Legitimate signed host)
- `dui70.dll` (Malicious sideloaded DLL)
- Various PNG files (Payload containers)
- **Registry Keys:**
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Pointing to LockScreenContentServer)
- **Network Indicators:**
- `gitnow[.]dev` (C2 / Tunneling endpoint)
- **Behavioral Indicators:**
- Unexpected PowerShell execution originating from clipboard pastes.
- `pythonw.exe` creating outbound WebSocket connections to port 443.
- Rapid deletion of PNG files immediately after download (cleanup).
## Associated Threat Actors
- **Unknown:** Currently attributed to an unclassified "miscreant" or unknown threat group.
## Detection Methods
- **Signature-based detection:** Monitor for the hash of the malicious `dui70.dll` and the specific Python reverse tunnel implant.
- **Behavioral detection:**
- Flag PowerShell processes executing `Invoke-Expression` against local text files.
- Monitor for `LockScreenContentServer.exe` loading unsigned or unexpected DLLs from `C:\ProgramData`.
- Alert on domain enumeration commands (e.g., `net group "Domain Admins" /domain`) originating from standard workstations.
- **YARA:** Target the unique PowerShell "Cloudflare verification" string and the Python-based WebSocket tunnel script.
## Mitigation Strategies
- **Prevention:** Block or audit the Windows Run dialog and restrict PowerShell execution via Execution Policies or AppLocker/Windows Defender Application Control (WDAC).
- **User Training:** Educate staff specifically on "ClickFix" and "TerminalFix" tactics—emphasizing that legitimate CAPTCHAs never require pasting commands into a terminal.
- **Hardening:** Implement EDR to detect DLL sideloading attempts in common system directories like `C:\ProgramData`.
## Related Tools/Techniques
- **ClickFix:** The predecessor social engineering technique using the Run dialog.
- **Steganography:** Similar to techniques used by groups like APT37 or SilverTerrier for payload delivery.
- **Chisel / Ngrok:** Functional equivalents to the custom Python reverse tunnel.