Actor Profile

TerminalFix is a coordinated campaign activity (variant of ClickFix social engineering technique) disclosed by Microsoft Threat Intelligence. The campaign targets organizations across multiple industries using compromised websites to deliver sophisticated multi-stage intrusions. Unlike traditional ClickFix campaigns that direct victims to Windows Run dialog, TerminalFix specifically directs users to Windows Terminal or PowerShell to increase successful execution of complex, multi-line scripts. The campaign demonstrates technical sophistication through its use of DLL sideloading, steganography, extensive reconnaissance capabilities, and custom reverse-tunnel implants. Attribution to a specific threat actor group has not been disclosed; this represents a named campaign operation with potential for hands-on-keyboard follow-on activity including privilege escalation, security control disablement, data exfiltration, and ransomware deployment.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Compromised websites display fake Cloudflare CAPTCHA overlays (T1189 - Drive-by Compromise) that trick users into executing malicious PowerShell commands (T1204.002 - User Execution: Malicious File). Execution: Multi-line PowerShell scripts download ZIP archives and execute batch files (T1059.001 - PowerShell, T1059.003 - Windows Command Shell). Defense Evasion: DLL sideloading via legitimate signed binary LockScreenContentServer.exe loading malicious dui70.dll (T1574.002 - DLL Side-Loading); steganographic payload concealment in PNG images (T1027.003 - Steganography); hidden folders in C:\ProgramData. Persistence: Registry Run keys (HKCU\...\Run) and scheduled tasks executing every 60 minutes (T1547.001 - Registry Run Keys, T1053.005 - Scheduled Task). Discovery: Extensive Active Directory reconnaissance including domain trust enumeration, domain admin discovery, AD user description harvesting, computer enumeration, and targeted server ping sweeps (T1482 - Domain Trust Discovery, T1087.002 - Domain Account Discovery, T1018 - Remote System Discovery). Command and Control: Python-based reverse WebSocket tunnel to gitnow[.]dev:443 providing SOCKS-style TCP proxy access (T1090 - Proxy, T1573 - Encrypted Channel); file-watch command execution loop using Invoke-Expression for asynchronous command shell (T1059.001).

Targets & Patterns

The TerminalFix campaign targets organizations across multiple industries without disclosed sector-specific focus, suggesting broad opportunistic targeting. The extensive Active Directory reconnaissance capabilities—including domain trust enumeration, domain admin group membership discovery, and AD user/computer enumeration—indicate the campaign specifically seeks enterprise environments with Active Directory infrastructure. The reconnaissance scripts operate in both English and Spanish locales, suggesting potential targeting of organizations in Spanish-speaking regions or multinational enterprises. The reverse-tunnel capability transforms compromised hosts into network pivot points, enabling attackers to identify and reach additional internal systems. The technical sophistication and multi-stage attack chain suggest targets of opportunity selected based on website compromise rather than pre-planned victim selection, though the AD-focused reconnaissance indicates intent to exploit enterprise network access for lateral movement, credential theft, and potential ransomware deployment.

Historical Context

TerminalFix represents an evolution of the ClickFix social engineering technique. Traditional ClickFix campaigns directed victims to the Windows Run dialog and typically delivered single infostealers. TerminalFix adapts this technique by directing users to Windows Terminal or PowerShell instead, which increases the likelihood that complex, multi-line scripts execute successfully. Unlike earlier ClickFix variants, this campaign deploys a sophisticated multi-stage attack chain rather than simple infostealer payloads. The progression from single-payload delivery to multi-stage intrusions with DLL sideloading, steganography, extensive reconnaissance, and custom reverse-tunnel implants represents a significant escalation in technical sophistication and operational intent compared to previous ClickFix-related activity.

Defensive Recommendations

  • Monitor for suspicious PowerShell execution with network download activity, particularly multi-line scripts executed via Windows Terminal or PowerShell following browser activity (T1059.001). Detect using Sysmon Event ID 1 and PowerShell ScriptBlock logging (Event ID 4104).
  • Detect DLL sideloading of dui70.dll by LockScreenContentServer.exe through monitoring for unusual DLL loads by signed Microsoft binaries. Implement application whitelisting and monitor ImageLoad events (Sysmon Event ID 7) for unexpected DLL paths in C:\ProgramData.
  • Hunt for steganographic payload extraction by identifying PowerShell scripts downloading PNG images followed by file writes of PE executables. Monitor network connections to image files with subsequent process creation from C:\ProgramData directories.
  • Detect Active Directory reconnaissance activity including rapid domain trust enumeration, domain admin queries, and AD user description harvesting. Monitor for suspicious LDAP queries, net.exe/nltest.exe usage, and PowerShell AD module commands (T1482, T1087.002).
  • Identify reverse tunnel deployment by detecting pythonw.exe execution with network connections to non-standard ports (443 to non-Microsoft domains), WebSocket traffic patterns, and outbound connections from Python interpreters. Block or monitor connections to gitnow[.]dev and investigate scheduled tasks or Registry Run keys launching LockScreenContentServer.exe from C:\ProgramData (T1090, T1573).