TerminalFix chains eight stages from a fake CAPTCHA to a reverse tunnel, and never touches a CVE. There is nothing to patch

What Microsoft actually described

On 28 August 2026 Microsoft published an analysis of a campaign it calls TerminalFix. A compromised website serves a fake Cloudflare Turnstile overlay, the familiar "verify you are human" checkbox. Interacting with it silently writes a PowerShell command to the visitor's clipboard, and the page then instructs them to paste it into Windows Terminal or PowerShell rather than the Run box.

What follows is eight stages long, and the interesting property is what it never does.

The command downloads an archive to C:\ProgramData\f47f2a8c21c9df4e containing exactly two files: LockScreenContentServer.exe, a legitimate signed Windows binary, and dui70.dll, unsigned, masquerading as the Windows DirectUI Engine and carrying a forged compile timestamp in the year 2104. The signed executable has a static import dependency on that DLL, and the Windows loader resolves the application directory before System32. Execution therefore begins inside a trusted, signed process.

From there the payload is decoded in memory from the DLL's resource section, and the next stage arrives inside three PNG images: the first eight bytes of the pixel data are the payload length as a 64-bit integer, and the remainder is the file. One image yields an executable, two yield halves of a DLL that are concatenated. The source images are deleted afterwards.

Persistence is set twice, through an HKCU Run key and a scheduled task re-running every 60 minutes, both named LockScreenContentServer_MuODG5yBM to sit alongside the legitimate Lock Screen component. Reconnaissance then enumerates domain trusts, domain administrators, and Active Directory users including their description fields, which is where administrators still leave passwords.

The last stage is the one worth dwelling on. The implant downloads an unmodified, signed, embeddable Python 3.14.5 from python.org over TLS, then runs client.py under pythonw.exe. The attacker brings their own interpreter, inheriting the trust of a legitimate open-source runtime. The tunnel reaches gitnow[.]dev:443 and upgrades to a WebSocket, with certificate verification explicitly disabled, SOCKS5-style address parsing that lets the operator reach any host the victim can see, and four rotating browser user-agent strings. On the wire it is an ordinary encrypted session to one destination.

There is no CVE, and that is the finding

We checked rather than assumed. The NVD API returns totalResults: 0 for ClickFix, for TerminalFix and for dui70. The CISA KEV catalogue, version 2026.08.27 with 1,685 entries, contains nothing related. Microsoft's own post names no CVE anywhere in its text.

That is not an oversight. No software flaw is exploited at any point in this chain. The clipboard, the terminal, the loader's directory search order, Run keys, Task Scheduler, ADSI and a signed Python runtime are all working exactly as designed. The only thing that goes wrong is that somebody pastes a command.

The practical consequence is uncomfortable for the way most organisations are wired. There is no patch to deploy, no KEV deadline to work to, and no vulnerability scanner finding to close. Every control that touches this is a policy or configuration decision that had to be made before the lure arrived.

The Terminal framing needs qualifying

Microsoft's own words are that directing victims to Terminal rather than Run "increas[es] the likelihood that complex, multi-line scripts execute successfully". The reasoning is sound and the numbers are real: the Run dialog passes its input to ShellExecute and is bounded by MAX_PATH, giving a practical maximum of 259 characters, while a cmd.exe command line is documented at 8,191. That is roughly thirty times the headroom, and it removes the need for the aggressive Base64 and concatenation tricks actors have used to squeeze a loader into 259 characters.

But "TerminalFix moves ClickFix to the terminal" is not the new part, and Microsoft's own earlier research says so.

There is a further wrinkle that cuts against the multi-line framing. Windows Terminal ships with multiLinePasteWarning set to true by default, and Microsoft Learn justifies it in exactly these terms: it is "useful if you often copy and paste commands from untrusted websites". On default settings a genuinely multi-line paste raises a dialog.

What Microsoft did not observe

This is the sentence that matters most, and it is the one the coverage drops. Microsoft writes:

Microsoft did not observe the downstream actions described below in the analyzed chain.

The downstream actions are privilege escalation, disabling security controls, data exfiltration and ransomware, which Microsoft frames conditionally as what "typically follows". The Hacker News reports it as: "The tech giant has warned that such access can be abused further to escalate privileges, disarm security controls, exfiltrate sensitive data, and deploy ransomware." That is a fair paraphrase of the conditional sentence, and it omits the disclaimer standing next to it. A reader of the coverage alone would reasonably conclude ransomware was part of this campaign. It was not observed in it.

The absence runs deeper than one sentence.

Ten distinct dui70.dll hashes are the only implicit hint at breadth, and Microsoft draws no conclusion from them. The honest summary is that this is a well-documented technique report, not an incident report with a measured footprint. Nobody has inflated the numbers, because there are no numbers to inflate.

Microsoft's own hunting query will not run

A small thing, and the kind that costs an analyst twenty minutes on a Monday. One of the four KQL hunting queries in the post contains Unicode curly quotes around its last two literals, which Defender advanced hunting will not parse.

$ | where ProcessCommandLine has_all ("client.py", "--server", "--uuid", “cert.pem”, “gitnow.dev”)

Syntax error: unexpected character

Worth checking the other three queries in your own tenant before trusting a clean result.

What to check this week

Note what is missing from that list. None of these stop the paste, they constrain what happens afterwards. Microsoft also recommends an ASR rule blocking JavaScript or VBScript from launching downloaded executable content, which appears to be boilerplate: no JavaScript or VBScript launches anything anywhere in the described chain, and that rule would not have interrupted this intrusion.

The position

The uncomfortable part is not the tunnel or the steganography, both of which are competent but unremarkable. It is that a chain this long, ending in a persistent network pivot with credential-harvesting reconnaissance, requires no vulnerability at all. This site keeps arriving at the same place from different directions: the Gitea flaw whose severity was really a configuration setting, the advisory that omitted everything a defender needed. Vulnerability management is a well-funded, well-tooled discipline pointed at the part of the problem that has a number attached to it.

The second thing worth carrying away is smaller and more immediate. Microsoft said plainly that it did not observe ransomware here, and within two days that sentence had fallen out of the retelling. When you brief this internally, brief the caveat with it.