Cyber Threat Brief — August 31 2026

1. TerminalFix Campaign — Fake CAPTCHAs to Reverse-Tunnel Backdoor

TL;DR: Microsoft disclosed a ClickFix variant (“TerminalFix”) that uses fake Cloudflare CAPTCHAs on compromised sites to trick users into pasting PowerShell into Windows Terminal, deploying DLL sideloading → steganographic payloads → AD recon → a Python reverse-tunnel C2 implant for persistent SOCKS-style network pivoting. Multi-sector targeting; full IOC list published.

What’s New:

• User pastes clipboard-hijacked PowerShell that downloads verify_pkg.zip, sideloads malicious dui70.dll via legitimate LockScreenContentServer.exe — all output masked as Cloudflare verification messages
• Sideloaded DLL retrieves payloads hidden in PNG pixel data (steganography) from bestsocialmedianewspapper[.]com / offlineupdater[.]com; DLL split across two images to evade content inspection
• Persistence via HKCU\...\Run key and scheduled task (60-min interval) under name LockScreenContentServer_MuODG5yBM; payload directory hidden with attrib +h +s
• Full AD recon: nltest /domain_trusts, net group "domain admins", ADSI user/computer enumeration, targeted ping sweeps of DCs, SQL, backup, mail servers
• Python reverse-tunnel (client.py via pythonw.exe) connects to gitnow[.]dev:443 over TLS WebSocket — multiplexes arbitrary TCP, rotating browser User-Agents, no visible window

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
gitnow[.]dev	C2 domain	T1572	DNS, proxy, firewall	Block and hunt in DNS/proxy logs
bestsocialmedianewspapper[.]com	Payload domain	T1105	DNS, proxy	Block — steganographic image hosting
offlineupdater[.]com	Payload domain	T1105	DNS, proxy	Block — failover payload delivery
18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f	SHA-256 (verify_pkg.zip)	T1204.002	EDR	Alert on download/extraction
b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36a	SHA-256 (client.py)	T1572	EDR	Alert on file creation
ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07	SHA-256 (dui70.dll)	T1574.002	EDR	Alert on DLL load
LockScreenContentServer.exe loading dui70.dll from C:\ProgramData\*	DLL sideload	T1574.002	Sysmon 7, EDR	Alert on this binary loading DLL from non-System32 paths
LockScreenContentServer_MuODG5yBM in Run key or scheduled task	Persistence	T1547.001, T1053.005	Registry, Sysmon 13, Task Scheduler	Hunt for this exact name in autostart entries
pythonw.exe with args client.py --server --uuid cert.pem	Tunnel launch	T1572	Sysmon 1, EDR	Alert on pythonw.exe with these command-line patterns
PowerShell downloading ZIP then launching batch from C:\ProgramData\	Initial execution	T1059.001	Script Block Logging (4104)	Hunt for Invoke-WebRequest → Expand-Archive → .bat from ProgramData

Detection

Source	Rule	Gap
Splunk ESCU	Suspicious DLL Side Loading from ProgramData, PowerShell - Connect To Internet With Hidden Window	No TerminalFix-specific rule; need LockScreenContentServer.exe sideloading + steganographic PNG download + reverse-tunnel via pythonw.exe
Elastic	Potential DLL Side-Loading via Trusted Microsoft Programs, Unusual Process Execution Path	No ClickFix/TerminalFix-specific rule; need clipboard-hijack → Terminal paste detection
Sigma	sysmon_dll_sideloading_non_system_path.yml, proc_creation_win_susp_powershell_enc_cmd.yml	No rule for steganographic payload extraction or pythonw.exe reverse-tunnel C2 pattern

Sources: Microsoft Security Blog, The Hacker News, GBHackers

---

Status Updates

• CVE-2026-82078/81578 (PaperCut NG/MF): Emergency Patch Release 2 available. 47% of installs on unsupported v23 remain vulnerable. Hunt for derby:memory:pwn in logs and .class drops in server/lib/. Original brief.
• CVE-2026-50656/69414 (ShieldBreak — Windows Defender): Still UNPATCHED. 100% success rate on Win11 25H2 and Server 2025. Apply WDAC/AppLocker mitigation. Monitor for mpengine.dll race-condition artifacts. Original brief.
• CVE-2026-8452 (Citrix NetScaler): Federal deadline passed Aug 29. Web shells (x.php, z.php) still being deployed. Verify with Bishop Fox SAML tool. Original brief.
• CVE-2026-53362 (Linux Kernel IPv6): CISA deadline passed Aug 30. Container escape via __ip6_append_data() OOB write still exploitable on unpatched kernels ≥6.0. Patch or disable IPv6 on container hosts. Original brief.