TerminalFix ClickFix variant deploys Python reverse tunnel via Cloudflare CAPTCHA and DLL sideloading

The attack begins with compromised websites serving spoofed Cloudflare verification pages that instruct users to paste and run a PowerShell one-liner. This downloads a ZIP containing LockScreenContentServer.exe and a malicious dui70.dll that sideloads, extracts steganographic payloads from PNGs hosted on bestsocialmedianewspapper[.]com and offlineupdater[.]com, then installs persistence via Run keys and scheduled tasks. Reconnaissance includes domain trust queries and internal host pings before deploying client.py for encrypted WebSocket tunneling of arbitrary TCP traffic.

Cloudflare's ubiquity as a CAPTCHA and WAF provider creates a trust surface that attackers now exploit at scale; the same pattern appeared in prior ClickFix operations but TerminalFix shifts execution context to Terminal and PowerShell to evade simple Run-dialog blocks. No independent technical attribution ties the infrastructure to a named group, though the tooling overlaps with commodity loaders observed in multiple ransomware affiliate campaigns.

Operational impact centers on the reverse tunnel granting inbound reachability to internal assets from a single compromised workstation. Defenders should prioritize AppLocker restrictions on PowerShell and scheduled task auditing over signature updates alone.

Next indicators to watch include new domains mimicking Cloudflare verification flows and increased use of Python-based implants in enterprise telemetry.