TERMINALFIX CAMPAIGN DEPLOYS A REVERSE TUNNEL THROUGH MULTISTAGE INTRUSION

Summary from the TLDR InfoSec newsletter

TerminalFix uses compromised sites and fake Cloudflare CAPTCHA prompts to copy malicious PowerShell into a victim's clipboard. The command downloads a ZIP, then abuses LockScreenContentServer.exe to sideload dui70.dll, which then extracts payloads from PNG pixel data, creates Run-key and scheduled-task persistence, and enumerates Active Directory, trusts, administrators, servers, and system details. A Python client opens a TLS WebSocket tunnel to gitnow[.]dev:443, allowing SOCKS-style access to internal hosts. Look out for nonstandard LockScreenContentServer.exe paths, dui70.dll loads, pythonw.exe client.py activity, and the listed C2 domains.