# TerminalFix Campaign Analysis: Risk of Active Directory Hijacking from Risky Terminal Operations ## **Executive Summary** Recently, Microsoft Threat Intelligence published analysis of a wide-area attack campaign called TerminalFix — a dangerous evolution from the social engineering technique ClickFix. Instead of just dropping single lines of information-stealing malware (infostealer) through the Windows Run dialog box (Win + R), TerminalFix tricks users into pasting complex PowerShell code into Windows Terminal or PowerShell Console, paving the way for multi-stage intrusion chains directly targeting enterprise infrastructure. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/27eccc65-5dc8-4f91-a43d-2bd1fc6832ec.png align="center") By combining DLL Sideloading via Microsoft's signed validation process (LockScreenContentServer.exe), hiding malware in PNG pixel data (Steganography), and deploying a WebSocket Reverse Tunnel written in Python, the attacker successfully established a network-level proxy tunnel (SOCKS-like tunnel). This mechanism helps attackers completely bypass Firewall/NAT barriers, scout Active Directory and create persistence in the victim system. * Who is affected: Businesses in all industries with end users/administrators with web access and permission to launch PowerShell/Windows Terminal on Windows workstations. * Priority action #1: Review and immediately prevent the launch of the LockScreenContentServer.exe process from paths other than the standard system directory, and tighten the PowerShell execution policy using AppLocker/WDAC and PowerShell Constrained Language Mode. ## Detailed Analysis of Attack Flows The TerminalFix campaign is a clear demonstration of the combination of sophisticated social engineering (Social Engineering) and advanced defense evasion techniques (Defense Evasion). Below is an in-depth analysis of each phase (Phase-by-Phase) in the attack flow from the first point of entry until the attacker completely masters the underground connection channel to the internal network. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/332e8de9-ba13-4fff-9f86-5d8ab517dc62.png align="center") ### PHASE 1: Initial Access & Social Engineering Vector Unlike traditional forms of malware distribution via email attachments (Phishing Email), TerminalFix abuses the Watering Hole technique or redirects users from malicious advertisements (Malvertising) to compromised websites. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/1fc4e6d9-f654-4d28-aa63-4a7a0a26589e.png align="center") 1. Fake CAPTCHA interface: The website displays a pop-up window that impersonates Cloudflare's robot verification system or browser display error. 2. Clipboard API exploit: When a user interacts with the "Verify You Are Human" button, a JavaScript code on the website will secretly call the navigator.clipboard.writeText() function to insert a malicious PowerShell command line into the System Clipboard. 3. The Human Prompt: On-screen instructions ask the user to perform a sequence of keyboard shortcuts: * Win + X (Windows Power User Menu) * Choose to open Terminal or PowerShell * Press Ctrl + V and Enter ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/2b1d5ae0-f494-43c7-80f2-79a73bff5654.png align="center") The entire `Write-Host part... Cloudflare` has no technical functionality — just to let the victim believe he or she is running the real Cloudflare testing tool. The real function is: download an archive from the attacker's server, extract it to C:\\ProgramData, and then execute the payload therein. Have you wondered why Windows Terminal instead of Windows Run (Win + R)? * No character limit: The Run dialog box (Win + R) only allows entering short strings (maximum 260 characters). Windows Terminal allows pasting a PowerShell script with hundreds of lines. * Bypass simple encryption command checks: Attackers do not need to use the -EncodedCommand parameter (which is easily detected by SIEM/EDR rules), but can write code directly with full loops and exception handling. ### PHASE 2: Execution & Staging When the command line is pasted and executed in Windows Terminal, the Stage 1 PowerShell script becomes active: 1. Anti-Analysis & Environment Check: Check if the workstation is running in a Sandbox (Cuckoo, Any.Run) or virtualized (VMware, VirtualBox) environment by querying WMI (Get-WmiObject Win32\_ComputerSystem). 2. **Download Stage 2 Payload (Stage 2 Zip Archive):** * Asynchronous query to domain C2 (`eg t.38[.]no`). * Download a lightly encrypted `.zip or .tar.gz` archive to bypass SWG filters. 3. **Download to location without Admin rights:** * The script extracts the content to a user directory with write permissions such as %APPDATA%\\Microsoft\\LockScreen\\ or %LOCALAPPDATA%\\Temp.... * The decompressed file structure includes: * `LockScreenContentServer.exe` (Windows standard system file, with valid Microsoft digital signature). * `dui70.dll` (Malicious DLL file has been modified/compiled separately). ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/b4d8ab29-56bf-4f7f-91cc-6da036029a0b.png align="center") ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/98468872-a9a7-4222-ac89-1036ef2a226f.png align="center") ### PHASE 3: Defense Evasion via DLL Sideloading DLL Sideloading technique is applied to deceive detection mechanisms based on process signature (Process Signature Verification). 1. DLL Search Order Hijacking mechanism: When `LockScreenContentServer.exe` is launched, by default of Windows OS, it needs to load the system library `dui70.dll` (DirectUI Framework). Windows' DLL search order will prioritize checking the current directory containing the `.exe` file before searching in `C:\Windows\System32`. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/22e349bc-045e-484c-a1c6-cf69a80296a1.png align="center") 1. Execute malicious code on behalf of Microsoft: Because the malicious `dui70.dll` file is placed right next to `LockScreenContentServer.exe`, a legitimate Microsoft process will automatically load the malicious code into its own memory space. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/aaa3b467-18c7-4138-a7aa-ef3ce05201a5.png align="center") 2. Evasion effectiveness: * EDR Bypass: EDR solutions see a valid Microsoft digitally signed process running, reducing the Threat Score. * Parent-Child Anomaly Avoidance: Malware executes inside LockScreenContentServer.exe instead of spawning a foreign process like `cmd.exe or powershell.exe` at later stages. ### PHASE 4: Payload Decoding Using PNG Steganography To download the main attack modules without being detected by network traffic censorship solutions (Secure Web Gateway - SWG), attackers hide payloads in `.png` image files. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f7419a86-2300-4481-9286-cd2d597619e3.png align="center") Pixel Extraction: Malicious DLL dui70.dll loads camouflaged image files (`e.g. logo.png, bg.png`). It accesses the image's pixel data array, extracting data from the Red, Green, Blue, Alpha (RGBA) color channels. Decoding & Restructuring: Each pixel contains scrambled bytes of malicious data. The DLL concatenates these bytes to recreate 2 components: * Python Portable Runtime: A miniature Python interpreter (no need to install on the system). * Python Implant Script: The main Python source code is responsible for reconnaissance and tunnel construction. ### PHASE 5: Persistence & Internal Reconnaissance After successfully loading the Python environment, the malware establishes long-term lying and internal reconnaissance capabilities. **Persistence** The malicious code adds a legitimate executable file that is sideloaded into the current user's Registry Run Key: * Registry Path: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` * Key Name: `LockScreenServerUpdate` * Value: `"%APPDATA%\Microsoft\LockScreen\LockScreenContentServer.exe"` ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/54a18bad-fcd1-42d5-ace9-9be763d87cef.png align="center") Every time a user logs in to Windows, LockScreenContentServer.exe automatically launches and reloads the malicious dui70.dll. **Active Directory Reconnaissance (AD Reconnaissance)** Python malware calls system API functions and queries LDAP/ADSI to collect internal network information: ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/a5b76cf4-3b2b-452b-910d-458752cd76ad.png align="center") * User & Group Discovery: List accounts belonging to the Domain Admins and Enterprise Admins groups. * Domain Trust Discovery: Check the list of Domain Trusts in the Active Directory forest (AD Forest). * SPN Enumeration: Search for Service Principal Name (SPN) accounts for future Kerberoasting attack techniques. ### PHASE 6: Command & Control via Encrypted WebSocket Reverse Tunnel This is the goal phase of TerminalFix: Turn the victim machine into a proxy intermediary (Reverse Tunneling Pivot Point). ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/0f21eadc-de37-409e-b965-0fe18c33b88e.png align="center") Initiate an Outbound WebSocket (WSS) connection: Python Implant proactively sends a wss:// (WebSocket Secure) connection request via port 443 TLS/SSL to the attacker's C2 Server. **Advantages of WebSocket Reverse Tunnel:** * Bilateral & Outbound connection direction: Because the connection originates from within the network going out (Outbound), the default Firewalls and NAT devices will allow it through. * Persistent Duplex Connection: The WebSocket protocol allows maintaining a continuous two-way data transmission channel without constantly creating new TCP connections like HTTP polling. **Reverse SOCKS Proxy mechanism:** * Attackers on the Internet cannot connect directly to the victim's computer due to NAT/Firewall problems. * However, through the already opened WebSocket tunnel, C2 Server can encapsulate malicious TCP/UDP packets sent to Python Implant. * Python Implant receives the packet, decodes it, and broadcasts it to the victim's internal network. * Result: Attackers anywhere in the world can use tools such as Nmap, Metasploit, Impacket to push traffic through the WebSocket tunnel to attack other servers in the internal network (Domain Controller, Database) as if they were sitting directly at the victim's office. ## Internal Reconnaissance Before activating the main C2 connection, the malware performs a reconnaissance of the entire victim network environment to evaluate the target value: * List workstation information, Domain Name, SID and list of local/domain accounts. * Perform Active Directory queries via LDAP/ADSI to collect a list of Domain Admins, Enterprise Admins and Domain Trust information. * Check the list of defense solutions (AV/EDR/EDR Drivers) running on the system. ## WebSocket Reverse Tunnel Mechanism TerminalFix's core goal is not just to steal cookies or browser passwords, but to establish a reverse tunnel. Activated Python implant malware opens an outbound TLS/SSL encrypted WebSocket connection (outbound port 443) to the attacker's C2 infrastructure: 1. Bypass Firewall/NAT: Because the connection originating from within the internal network goes out via the HTTP/WebSocket protocol (Port 443), most stateful firewalls allow this traffic through. 2. Reverse SOCKS Proxy: When the WebSocket connection is successfully established, the C2 server can send encapsulated TCP/UDP packets via WebSocket. The Python implant at the victim's computer will receive the packet, decode it and forward it directly to other internal IP addresses in the network (Domain Controllers, File Servers, Internal Web Apps). 3. Lateral Movement: Attackers on the internet can now direct traffic from their attack machine through the victim machine to perform port scans, Password Spraying attacks, or exploit internal vulnerabilities (Kerberoasting, Pass-the-Hash) as if they were plugged into the network directly at the business office. ## IOCs ### **File Indicators (Hashes)** * 8f4a9b2c3d1e5f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a * 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b * 9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e * e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 ### **Network Indicators** * t.38\[.\]no * verify-captcha-cloud\[.\]com * fix-terminal-auth\[.\]net * wss://ws.tunnel-connect-service\[.\]org/v1/connect * wss://185.220.101\[.\]45:443/stream * IP C2: 185.220.101\[.\]45 * IP C2: 45.142.214\[.\]12 ### **Host-based Artifacts** * Registry Persistence * HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run * Key Name: LockScreenServerUpdate * Value: "%APPDATA%\\Microsoft\\LockScreen\\LockScreenContentServer.exe" * Unusual File Paths (LockScreenContentServer.exe running outside C:\\Windows\\System32) * %APPDATA%\\Microsoft\\LockScreen\\LockScreenContentServer.exe * %LOCALAPPDATA%\\Temp\\\*\\LockScreenContentServer.exe * %APPDATA%\\Local\\Temp\\\*\\dui70.dll ## **MITRE ATT&CK Mapping**

Tactic

Technique ID

Technique Name

Application Description in TerminalFix Campaign

Initial Access

T1566.002

Phishing: Spearphishing Link

Utilizing compromised websites to redirect users to a Fake CAPTCHA screen.

Execution

T1059.001

Command and Scripting Interpreter: PowerShell

Tricking users into pasting a complex PowerShell script into the Windows Terminal / PowerShell Console.

Execution

T1204.002

User Execution: Malicious File

The user directly performs the action of pasting the command and triggering the payload execution chain.

Persistence

T1547.001

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Writing a Registry Run Key to configure LockScreenContentServer.exe to start with the system.

Defense Evasion

T1574.002

Hijack Execution Flow: DLL Side-Loading

Abusing the legitimate, Microsoft-signed LockScreenContentServer.exe process to load a malicious dui70.dll.

Defense Evasion

T1027.003

Obfuscated Files or Information: Steganography

Hiding the Python malware payload inside .png image files via RGBA pixel data.

Discovery

T1087.002

Account Discovery: Domain Account

Reconnaissance of Active Directory account information, Domain Admins, and Group Policy lists.

Discovery

T1482

Domain Trust Discovery

Enumerating trust relationships between domains within the Active Directory infrastructure.

Command and Control

T1572

Protocol Tunneling

Establishing an encrypted WebSocket Reverse Tunnel over port 443 to turn the victim machine into a Reverse SOCKS Proxy.

## Expert Comments ### Evaluate the Level of Sophistication TerminalFix marks an important tactical shift for cybercriminal groups. They realize that exploiting software vulnerabilities (Zero-day/N-day) is resource-intensive and easily patched, while humans are still the weakest link. * Exploiting the habits of technical users: Many Devs, DevOps and System Admins at businesses have the habit of copying/pasting command lines from the Internet (StackOverflow, ChatGPT, forums) into Terminal to fix errors. Fake CAPTCHA screens hit the "need to pass verification step to continue working" mentality. * Perfect combination of Evasion & Persistence: DLL Sideloading hides behavior under valid Microsoft process + Steganography via PNG bypasses most SWG/Proxy web content filters + Reverse Tunnel via WebSocket 443 bypasses Stateful Firewall. This is a very carefully calculated series of attacks to maintain a long-term presence (large dwell time). ### Risks for Businesses in Vietnam In Vietnam, the IT and SOC infrastructure of many banks, financial institutions and large businesses are facing major challenges from this technique: 1. Lack of Outbound WebSocket data flow monitoring: Network monitoring systems often only focus on monitoring regular HTTP/HTTPS traffic but rarely analyze in depth the nature of long-lived connections such as WebSocket (ws:// / wss://). 2. Loose PowerShell permissions: Many regular office user workstations (HR, Accounting, Sales) still retain the right to launch powershell.exe or cmd.exe without being restricted by AppLocker or WDAC policies. 3. Subjective habits with image files: .png, .jpg image data are often considered absolutely safe and bypass deep censorship, creating ideal conditions for the Steganography technique to take effect. ## Defense & Response Recommendations ### Emergency Action (Immediate: 0 - 24 hours) * Hunting unusual processes: Launch an EDR/SIEM query that searches for LockScreenContentServer.exe processes launching from any path NOT C:\\Windows\\System32\\ or C:\\Windows\\SysWOW64. * `Get-Process -Name "LockScreenContentServer" -ErrorAction SilentlyContinue |` `Select-Object Id, ProcessName, Path |` `Where-Object { $_.Path -notlike "C:\Windows\System32\*" }` * Block Domains & IP IOCs: Add all domains (\*.38.no, verify-captcha-cloud\[.\]com) and C2 IP list to the blacklist on Firewall, DNS Filter and SWG. * Check for suspicious WebSocket connections: Review outbound HTTPS/WebSocket connections that have unusual connection retention times lasting hours from workstations that are not part of the Server/Dev group. ### Short-term Solution (Short-term: 1 - 7 days) * **Tighten PowerShell execution policy:** * Enable PowerShell Constrained Language Mode for all users other than Domain Admin via Group Policy Object (GPO). * Enable Script Block Logging (Event ID 4104) and Logging Module to record the entire content of executed PowerShell commands and send them to SIEM/SOC. * Deploy AppLocker / Windows Defender Application Control (WDAC): * Prevent regular users from launching powershell.exe, wt.exe, cmd.exe, or cscript.exe without a specific business requirement. * Prevent execution of binary files from temporary directories such as %APPDATA%, %LOCALAPPDATA%\\Temp, %PUBLIC%. ### Long-term Strategy * Advanced cyber security awareness training (Security Awareness): Update Phishing/ClickFix drill script. Emphasize the rule: "Never press Win+R or open Terminal to paste any line of code as instructed by an Internet site." * Apply Zero Trust & Network Segmentation model: Strict network partition between workstation range (Workstation Zone) and administration server range (Server/DC Zone). Prevent workstations from connecting directly to other workstations (Disable Peer-to-Peer lateral traffic). * Deploy EDR/XDR supporting Behavioral Analysis: Use next generation EDR solutions capable of detecting DLL Sideloading behavior based on digital signature origin and anomalous parent-child processes. ## References [Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines](https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480) [TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/) [TerminalFix looks like ClickFix, but delivers a very different payload | Malwarebytes](https://www.malwarebytes.com/blog/news/2026/09/terminalfix-looks-like-clickfix-but-delivers-a-very-different-payload) [TerminalFix Uses Reverse Tunnels for Persistent Access](https://socprime.com/active-threats/terminalfix-campaign-builds-reverse-tunnels-for-persistent-access/)