TerminalFix: The ClickFix lure moves to Windows Terminal and ends in a covert tunnel

Sophos threat researchers have published their analysis of a cluster of managed detection and response cases, tracked as STAC4924, that began with a social engineering lure and ended with an encrypted tunnel into the victim's network. The investigation started in August 2026. The lure is a variant of ClickFix that the researchers call TerminalFix, and the payload is a loader first documented by BlueVoyant in February 2026 under the name Lorem Ipsum.

The campaign is worth reading closely for two reasons. The tradecraft is unusually careful about evading the heuristics that catch commodity malware. And the group behind it has a ransomware history, even though no encryption has been observed in this activity.

From ClickFix to TerminalFix

A classic ClickFix page tells the victim to open the Run dialog with Win+R and paste a command. The TerminalFix variant tells them to open Windows Terminal instead. The difference sounds trivial, but it sidesteps detections and user guidance that were written around the Run dialog, and a terminal window looks like something an administrator would use, which makes the instruction feel more legitimate rather than less.

According to Dark Reading's earlier reporting on the same loader, the pasted command is presented as a Microsoft Edge security intelligence update and prints a fake success message once the real work is done.

The chain, step by step

1. The PowerShell command downloads a ZIP archive containing a legitimate Windows executable, a malicious DLL with the name of a library that executable expects, and a batch script.
2. The batch script installs persistence through auto-run registry entries named to look like Microsoft components, plus scheduled tasks, and then launches the legitimate executable.
3. The executable loads the attacker's DLL from its own folder. Sophos lists a dozen sideloading pairs, including LockScreenContentServer.exe with dui70.dll, changepk.exe, werfaultsecure.exe, phoneactivate.exe and wuauclt.exe paired with libraries such as slc.dll, faultrep.dll, sppcext.dll and sspicli.dll.
4. The DLL contains the Lorem Ipsum Loader. Its shellcode is not stored as bytes but as ordinary English words, decoded through lookup tables at runtime. Entropy-based detection, which looks for packed or encrypted blobs, sees prose.
5. The loader requests an attacker-controlled profile on Letsdiskuss, a legitimate discussion platform, extracts an encoded string from the profile and decodes it into the current list of command and control servers. Rotating infrastructure only requires editing a profile.
6. Command and control traffic travels in HTTP POST requests dressed as JPEG images.
7. The operators run PowerShell reconnaissance, including Active Directory discovery, then download the official Python embeddable package from python.org into Users\Public\indigo.
8. They run client.py, a custom implant that opens an encrypted WebSocket connection to their servers, assigns the host a unique identifier and relays traffic through it. From that point the attacker can reach internal resources while the traffic blends in with ordinary web activity.

Who is behind it, and what the tunnel is for

Sophos assesses with moderate confidence that both phases of the campaign belong to the group it tracks as GOLD VICTOR, also known as Vanilla Tempest, DEV-0832 and Vice Society, which has deployed Vice Society and Rhysida ransomware. The assessment rests on shared callback structures, the reuse of the Letsdiskuss dead drop across phases and the evolution of the sideloading and persistence techniques.

The earlier phase, between March and April 2026, used SEO-poisoned websites distributing trojanised Microsoft Teams installers. The switch to TerminalFix in late May coincided with Microsoft's disruption of a malware signing service that had supplied the certificates, a dependency the attackers replaced within days.

A tunnel with a per-host identifier and no encryption payload is what access looks like before it is used or sold. In our incident response work, this stage is the last moment at which an intrusion is cheap to contain. After it, the next event is usually data theft, ransomware, or both.

Detection opportunities

• Windows Terminal or PowerShell spawning a download cradle shortly after a browser session.
• Batch scripts creating Run keys whose names imitate Microsoft components, and scheduled tasks created in the same minute.
• Legitimate Windows binaries executing from user-writable folders, especially the pairs Sophos lists.
• Connections to letsdiskuss.com from processes that are not a browser.
• HTTP POST requests carrying image content types from unexpected processes.
• python.exe running from Users\Public\indigo, and WebSocket connections originating from Python.

Sophos has released detection names for the components and a full indicator list in its GitHub repository.

What to do now

1. Hunt for the artefacts above across the estate, prioritising workstations of users with administrative or financial roles, which are the usual ClickFix targets.
2. If you find the tunnel, treat the network as reached. Identify what the host could see, review authentication logs for the period, rotate credentials used from that machine and look for the reconnaissance output the operators collected.
3. Restrict what users can paste. Constrained language mode for PowerShell, application control for unsigned DLLs loading into signed processes and blocking of Windows Terminal for users who do not need it remove most of the chain without touching the lure.
4. Update awareness material. Training that only mentions Win+R is already out of date. The durable rule is that no verification step, update prompt or support page asks a user to paste a command.
5. Review internet-facing exposure of what the tunnel would reach. A relay on a workstation is only as dangerous as the flat network behind it.

A note for insurers and boards

STAC4924 is pre-ransomware activity by a ransomware group. Detecting it at the tunnel stage is the difference between an afternoon of incident response and a business interruption claim. The question to ask is not whether users have been trained, but whether endpoint telemetry would show a signed Windows binary loading a DLL from a user folder and Python opening a WebSocket from a public directory.

Sources

• Sophos: TerminalFix and Lorem Ipsum Loader enable covert tunneling
• Dark Reading: 'Lorem Ipsum' malware pivots to ClickFix delivery