Microsoft identifies TerminalFix campaign spreading Python reverse tunnel

September 2, 2026 at 04:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Microsoft Threat Intelligence identified a social engineering campaign dubbed TerminalFix that deploys a custom Python-based reverse tunnel implant, granting attackers access to internal networks. The campaign uses fake Cloudflare CAPTCHAs on compromised websites to trick victims into pasting commands into Windows Terminal or PowerShell. The malware hides its activity through DLL sideloading and steganography, establishing persistence and full SOCKS-style TCP proxy access.

Key Facts

Microsoft Threat Intelligence identified the TerminalFix campaign on Friday, according to a report.
TerminalFix is a variant of the ClickFix technique that instructs victims to paste commands into Windows Terminal or PowerShell instead of the Run dialog.
The malware establishes persistence through a registry Run key and a scheduled task named LockScreenContentServer_MuODG5yBM that runs every 60 minutes.
The final payload is a custom Python-based reverse tunnel implant that connects outbound over TLS port 443 and upgrades to a WebSocket.
The malware installs a legitimate signed Python runtime from python.org and launches the tunnel via pythonw.exe without a visible window.

Attack Chain

TerminalFix lures are planted on compromised websites that display a fake Cloudflare CAPTCHA and instruct visitors to paste commands to proceed. When commands are run, fake verification status messages appear in the terminal while a ZIP archive downloads from attacker infrastructure and a batch file executes. DLL sideloading hides malicious activity within trusted signed processes: a DLL disguised as dui70.dll is placed alongside a legitimate signed LockScreenContentServer.exe executable. The malicious DLL runs a PowerShell script that downloads additional payloads as PNG image files, with binaries embedded in the RGBA channels using steganography. The extracted payloads include an executable and another DLL split across two different images.

Reconnaissance and Command-and-Control

The malware performs system reconnaissance by collecting metadata across English, Spanish, and German locales. It performs domain trust discovery, domain admin enumeration, and Active Directory user and computer enumeration. It pings a list of named servers across common infrastructure roles such as domain controllers, databases, backups, gateways, and mail systems to map accessible assets. A primitive but effective asynchronous command-and-control is established via a local text file that the malware continuously watches for changes, executing any PowerShell commands found there and writing output to a separate file.

Reverse Tunnel Implant

The final payload is a custom Python-based reverse tunnel implant that connects outbound over TLS port 443 and upgrades to a WebSocket. This grants the attacker full SOCKS-style TCP proxy access through the victim's network. The malware installs a legitimate signed Python runtime directly from python.org and launches the tunnel without a visible window via pythonw.exe. TCP proxying enables the attacker to reach any accessible internal host or port, with user agents imitating four different browsers randomly selected for each connection.