Cybersecurity News

Cybersecurity News: Fake CAPTCHA Opens Network Tunnel

Published August 31, 2026 · DNS Benchmark Pro Editorial · Reading time: 6 minutes

TL;DR — The cybersecurity news that matters most this week is not a zero-day vulnerability — it is a copy-and-paste. On 28 August 2026 Microsoft Threat Intelligence published analysis of TerminalFix, a ClickFix variant that plants a fake Cloudflare Turnstile overlay on compromised websites and instructs visitors to paste a “verification” command into Windows Terminal or PowerShell rather than the Run dialog. The chain that follows is not an infostealer. It is DLL sideloading through a signed Microsoft binary, second-stage payloads hidden inside PNG pixel data, dual persistence, full Active Directory reconnaissance, and finally a Python reverse-tunnel implant that hands the operator SOCKS-style TCP proxy access to everything the victim workstation can reach. Every stage after the paste depends on name resolution — which makes recursive DNS the cheapest place most organisations can still break the chain.

Enterprise defence has spent three years hardening the perimeter against unauthenticated remote code execution. TerminalFix is a reminder that the most reliable way into a network in 2026 is still to ask politely. This item of cybersecurity news is worth a briefing at your next change board not because the malware is novel — individually, none of the techniques are — but because of what the operators chose to build at the end of the chain. Earlier ClickFix campaigns dropped a credential stealer and left. This one builds a tunnel and stays.

Microsoft researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan describe a campaign targeting organisations across multiple industries, with reconnaissance scripts written to parse output in both English and Spanish locales — a small detail that suggests a deliberate targeting footprint rather than opportunistic spray.

Why Windows Terminal instead of the Run dialog

Classic ClickFix lures steer the victim to Win+R. That works, but the Run dialog is a hostile environment for an attacker: it is a single line, it truncates, and multi-line or heavily encoded scripts frequently fail to execute cleanly. Redirecting the victim to Windows Terminal or PowerShell removes that constraint entirely. The operator can now deliver a long, formatted, multi-stage script and expect it to run exactly as written.

It also improves the social engineering. A terminal window that prints a cyan “Starting Cloudflare verification…” banner and then a green “I am not a robot — Cloudflare ID: f47f2a8c21c9df4e” confirmation looks, to a non-specialist, exactly like a verification tool doing its job. The command is designed to produce reassuring output while it works. The victim watches a progress narrative, not an intrusion.

Behind that narrative, the script downloads a ZIP archive using a custom User-Agent header, extracts it to C:\ProgramData\f47f2a8c21c9df4e, and silently launches a batch file.

The chain: signed binaries, hidden pixels and IT security blind spots

The archive contains two files. One is LockScreenContentServer.exe, a legitimate signed Windows executable. The other is dui70.dll, an unsigned impostor claiming to be the Windows DirectUI Engine and carrying a forged compile timestamp dated 2104.

Because the Windows loader searches the application directory before System32, the planted DLL wins. Execution begins inside a trusted, signed process — inheriting its reputation and defeating any control that keys on process identity alone. The malicious DLL then decodes an obfuscated payload from its own resource section entirely in memory, so the decoded stage never touches disk.

Stage	Technique	Defensive signal it evades
Initial access	Fake Cloudflare Turnstile overlay on a compromised site	No attachment, no macro, no exploit to detect
Execution	User-pasted PowerShell in Windows Terminal	Legitimate user, legitimate shell, no parent-process anomaly
Payload delivery	DLL sideloading via signed `LockScreenContentServer.exe`	Signature and reputation checks on the running process
Second stage	Executable and DLL halves hidden in PNG pixel data	Content inspection and file-type detection in transit
Persistence	Run key plus 60-minute scheduled task, hidden folder	Single-mechanism persistence hunting
C2	Python reverse tunnel over WebSocket on port 443	Egress filtering that trusts outbound TLS

Steganography as a transport-layer evasion

The second stage is the part worth understanding properly. The sideloaded DLL runs PowerShell that fetches three PNG images from attacker-controlled domains. An Extract-RawFileFromImage routine walks each pixel’s RGBA channels, reads the first eight bytes as a 64-bit payload length, and reconstructs the embedded binary from the remainder.

The executable comes out of the first image. The DLL is split in half across the second and third and concatenated on disk. Nothing crossing the wire is recognisable as an executable, and no single image contains a complete payload. Once extraction finishes, the source images are deleted to reduce forensic artefacts. For any inspection tier that relies on identifying PE headers in transit, this is invisible traffic.

Cybersecurity news analysis: verified DNS Benchmark Pro capture of DNS server performance and resolver response validation used when blocking malware command-and-control domains at the DNS layer — Verified, unmodified capture from the DNS Benchmark Pro engine. TerminalFix retrieves its second stage from named hosts and tunnels out to a named host — so a resolver that answers quickly and applies threat-intelligence blocking correctly is a genuine control surface, not a convenience. Measuring what your resolvers actually do is the first step in trusting them with that job.

The reverse tunnel is the real payload

After establishing persistence through both an HKCU\...\Run key and a scheduled task that re-executes every 60 minutes, the malware performs the reconnaissance you would expect from an operator planning to stay: domain trust enumeration, domain admin group membership, Active Directory user and computer searches, Active Directory user description harvesting, and targeted ping sweeps against named servers to map internal topology.

It also installs a crude but effective asynchronous shell — a PowerShell loop that watches a text file for new commands, executes them via Invoke-Expression, and writes results to an output file.

Then it downloads a Python runtime and a bespoke client.py implant, launched through pythonw.exe with no visible window. The implant opens an encrypted WebSocket tunnel to gitnow[.]dev:443 and tunnels arbitrary TCP traffic in both directions. The operator can now reach any host visible from the victim’s network, from the outside, through a session that leaves the building as ordinary outbound TLS on the one port nobody blocks.

Microsoft is careful to note that it did not observe the downstream phase in the chain it analysed. But it is explicit about what that access enables: privilege escalation, disabling security controls, data exfiltration and ransomware deployment. Its guidance is to treat any affected device as a network pivot point and investigate for lateral movement and credential exposure — not to clean the endpoint and close the ticket.

DNS security is the choke point defenders still control

Strip the campaign back to its dependencies and a pattern appears. The victim reaches a compromised site by name. The ZIP archive is fetched from a named host. The steganographic images come from two named content domains with failover between them — bestsocialmedianewspapper[.]com and offlineupdater[.]com. The tunnel dials gitnow[.]dev. Five separate stages, five DNS lookups, and not one of them succeeds if resolution fails.

That is unusual leverage. You cannot patch your way out of a user pasting a command — there is no CVE here. You can, however, decide what your resolvers are willing to answer. A recursive tier with current threat intelligence, newly-registered-domain policy and proper logging turns a five-stage intrusion into a failed download and an alert. The failover between two content domains tells you the operators already consider single-domain blocking a live risk; they built redundancy specifically because they expect resolution to be denied somewhere.

Two operational caveats matter. First, DNS-layer enforcement only works if clients cannot bypass it. Endpoints resolving through an unmanaged public DoH provider route straight past your policy, which makes where DNS over HTTPS terminates a security decision rather than a privacy preference. Second, a filtering resolver is on the critical path of every connection your business makes. If it adds 200 ms of network latency or fails open under load, it will be disabled by whoever owns the help-desk queue, and you will lose the control entirely. DNS server performance is therefore a security property here, not a tuning detail — knowing the real numbers before you deploy is not optional.

Chart from an earlier release of the DNS Benchmark Pro network diagnostic tool comparing DNS over HTTPS response times and network latency across public resolvers, referenced in cybersecurity news analysis of command-and-control domain blocking — Unmodified capture from the DNS Benchmark Pro engine as it stood in August 2026. **Correction (15 August 2026):** the release that produced this chart timed opaque browser requests and did not verify that a response was a valid DNS answer, so the figures shown may include HTTP errors and unreadable replies counted as fast responses. They should not be relied on. The engine was rebuilt to validate every response; see the current methodology. The underlying point — that comparing the whole field beats spot-checking one provider — still holds.

What to do this week

Microsoft’s mitigation guidance is unusually actionable, and most of it costs nothing but a Group Policy change.

Restrict interactive script execution for standard users. AppLocker, App Control for Windows or Group Policy can prevent ordinary accounts from running PowerShell interactively. Consider blocking or auditing the Win+R dialog where it is not required.
Enable PowerShell script block logging. Without it, an obfuscated pasted command is invisible after the fact. With it, the cyan Cloudflare banner is a signature.
Hunt for DLL sideloading indicators — unsigned DLLs sitting beside signed Microsoft binaries in C:\ProgramData, and processes loading modules from non-system paths.
Block the published C2 and content domains at the resolver, then check whether your DNS tier would have blocked them before Microsoft named them. That answer defines your actual exposure to the next campaign.
Benchmark the resolvers you rely on. A network diagnostic tool tells you in minutes whether adding a filtering tier costs single-digit or triple-digit milliseconds, and whether it validates responses or merely returns something.
Brief users on the specific lure. Legitimate CAPTCHAs never ask you to open a terminal. That single sentence, delivered widely, is worth more than most security awareness modules.

Why it matters for tech infrastructure

The uncomfortable conclusion in this week’s cybersecurity news is that TerminalFix required no vulnerability, no stolen credential and no compromised supplier. It required a compromised website, a convincing overlay, and one person who wanted to read an article. The initial-access cost is close to zero; the outcome is a persistent TCP proxy inside the perimeter.

That economics will be copied. As enterprise IT security tightens around unauthenticated remote code execution — and 2026 has been a relentless year of exactly that — operators are migrating to the one interface that cannot be patched. Expect further ClickFix derivatives that target whichever shell is most permissive on the target platform, and expect them to end in tunnels rather than stealers, because network-level proxy access is worth far more on the criminal market than a browser credential dump. Hybrid estates should assume the pivot does not stop at the LAN edge either: a workstation with cached cloud tokens is a cloud security problem the moment it becomes a proxy.

For defenders, the structural lesson is that detection has to move to the layer the attacker cannot avoid. Signed processes lie. Encrypted outbound TLS on port 443 tells you nothing. Pixel data is not inspectable at line rate. But every stage of this campaign had to ask a resolver a question first — and a resolver you own, measure and log is one of the few controls in this chain that still answers to you.

Sources: Microsoft Security Blog, “TerminalFix campaign deploys a reverse tunnel through multistage intrusion” by Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan (28 August 2026); The Hacker News reporting on the Microsoft Threat Intelligence disclosure (30 August 2026); MITRE ATT&CK techniques T1574.001 (DLL side-loading), T1547.001 (Registry Run keys), T1053.005 (Scheduled Task) and T1564.001 (hidden files and directories). Defanged indicators are reproduced from Microsoft’s published analysis. This article is independent editorial analysis and is not affiliated with or endorsed by Microsoft Corporation or Cloudflare, Inc.