RWP Ventures RWP VenturesIntelligence

Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-28 and was added to the RWP archive on 2026-09-07.

Daily Top · Malware

TerminalFix was ClickFix that kept going — stego PNGs, AD recon, then a Python reverse tunnel

Fake Cloudflare CAPTCHA, LockScreenContentServer.exe + dui70.dll sideload, payloads in PNGs, Run keys and scheduled tasks, then pythonw client.py to gitnow[.]dev:443 as a SOCKS-style proxy.

RWP Ventures · 2026-09-07 · event 2026-08-28 · 1 min read · priority 8.3

Bottom line up front

CONFIRMED Microsoft 28 August 2026 — TerminalFix is ClickFix that does not stop at a stealer. User-pasted PowerShell pretends to be Cloudflare verification, pulls a ZIP with legitimate LockScreenContentServer.exe and malicious dui70.dll (sideload). DLL fetches steganographic PNGs, dual persistence (Run + scheduled task), domain-trust enum, domain-admin discovery, AD description harvest, server ping sweeps, then a hidden pythonw reverse-tunnel implant over WebSocket/TLS 443 to gitnow[.]dev — arbitrary TCP through the victim. That is a foothold for hands-on-keyboard, not a credential dump.

Historical backfill of 28 August 2026 reporting; added 7 September 2026.

What happened

ClickFix matured. The paste is still the exploit. The payload is now a network implant.

Why it mattered

"We blocked AMOS last quarter" is not a control. A Python tunnel on 443 looks like a developer laptop.

Who / what was affected

Microsoft-observed Windows enterprises. Counts UNKNOWN.

Technical context

Block user-pasted powershell from browsers. Hunt dui70.dll next to LockScreenContentServer.exe, PNG downloaders, pythonw with no window, gitnow[.]dev.

Exploitation / threat status at the time

CONFIRMED Microsoft chain.

UNKNOWN actor cluster name.

What defenders should have done

  1. Attack-surface reduction: no powershell from Office/browser.
  2. Treat ClickFix as incident, not malware-alert-and-reimage-only.
  3. Hunt AD recon immediately after a paste-lure ticket.

RWP assessment

Confidence: High. ClickFix is now an access broker.

Defensive actions

  1. Clipboard-to-terminal user training is necessary and insufficient.
  2. EDR for sideload + pythonw.
  3. Assume the tunnel means the WAN is already inside.

Sources

  1. Microsoft — TerminalFix campaign deploys a reverse tunnel
  2. Microsoft — macOS ClickFix campaign learned to hide
  3. Microsoft — Impersonating IT support (adjacent remote-access persistence)

Related intelligence