TerminalFix Lures Trick Users Into Installing a Hidden Tunnelling Tool

Sophos analysts began investigating a series of Managed Detection and Response cases in August 2026 that involved ClickFix-style lures. Instead of asking victims to open the Run dialog box, these lures tell users to open a Windows Terminal window. Sophos calls this variation TerminalFix. It is not tied to one threat group or a single campaign, and several malicious campaigns in 2026 have used it. The cases ended with a Python-based tunnelling implant being deployed.

When a victim follows the lure, they run a PowerShell command that downloads a ZIP archive. It contains a legitimate Windows executable, a malicious DLL and a batch script. The script sets up several persistence mechanisms and launches the legitimate file, which loads the malicious DLL through DLL sideloading. The DLL runs Lorem Ipsum Loader, which hides its shellcode as English words rather than raw binary data to avoid entropy-based detection. Sophos linked the intrusions to a broader campaign, active since at least March, that it tracks as STAC4924.

The loader then contacts an attacker-controlled profile on the legitimate Letsdiskuss platform and decodes a string there to find its current command and control servers. It talks to those servers using HTTP POST requests that appear to contain JPEG images, but the images carry encoded data. Using trusted platforms and disguised traffic can make this activity harder to spot.