This week, we briefed our clients on a new ClickFix variant, TerminalFix, that establishes a Websocket tunnel to the threat actor's C2 domain.
KEY TAKEAWAYS
ClickFix attacks continue to be one of the most common initial access techniques used by threat actors today. This simple technique shows the unsuspecting user what appears to be a Cloudflare-style CAPTCHA listing a series of steps to "verify you are human". However, if the user follows the steps, they will execute code that facilitates the download and execution of malware, typically infostealers or loaders which ultimately lead to ransomware.
Microsoft recently published a security blog detailing a new ClickFix campaign they are calling TerminalFix. What sets this campaign apart from previous ClickFix-style campaigns is the end result: Instead of infostealers or loaders, the downloaded malware runs a Python script to establish a Websocket tunnel to the threat actor C2 domain, giving them a SOCKS-style TCP proxy into the victim's network.
The Infection Chain
The infection begins when the user visits a compromised or attacker-controlled domain and is displayed the ClickFix lure:
Fig. 1: ClickFix Prompt (Source: Microsoft)
If the user follows all of the steps listed, they wind up pasting and executing a PowerShell command into the PowerShell terminal. This command downloads a ZIP file into C:\ProgramData from an attacker domain. Once extracted, this file executes a signed, legitimate binary called LockScreenContentServer.exe which loads a malicious DLL file, dui70.dll. This DLL file executes additional PowerShell code that downloads a series of PNG files from an attacker-controlled domain. These PNG files contain fragments of another DLL file. Using steganography, the PowerShell code extracts these DLL fragments and then reassembles them.
After validating the newly created files exist, the script then creates a registry run key as well as a scheduled task to ensure the files are executed once an hour to check for additional updates from the C2 server.
Once this persistence is created, the malware then does extensive reconnaissance of the victim's environment, gathering system information from the infected host, Active Directory enumeration using net.exe, network probing using ping.exe.
The script also downloads the Python runtime environment, and executes a Python payload called client.py, which establishes the WebSocket C2 tunnel to gitnow[.]dev over port 443. This established tunnel allows the threat actor to pivot to any host that is visible from the victim's network.
How to Protect Your Organization
While this specific ClickFix variant uses crafty techniques for its infection and persistence, it is very noisy to any network with good visibility. There are a variety of controls that will help with detecting and preventing these attacks:
Resources
https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
https://www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/
On September 1, Brian Krebs published a blog detailing his findings of approximately 153 million drivers licenses from people living in the United States and Canada. The information was observed on the dark web at a site called Nexus, in a search tool called the Identity Document Database. In addition to the drivers licenses, the database also claimed to contain over 10 million other identification cards, over three million travel documents, and over 579,000 medical cards. It also appeared that the database was growing in real time, with over 400,000 records added in a 24-hour period, suggesting the data was being harvested in an ongoing basis.
Further research indicates that the data appears to be sourced from idscan[.]net, which provides identity verification services for a variety of brands including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment.
The FBI has also confirmed that they are actively investigating this data breach.
As of September 1, the Nexus dark web site that was selling the data is no longer reachable. While the site is not accessible, the threat actors still have the data. Individuals can take a variety of steps to protect themselves from this sort of data disclosure:
Resources
Vulnerability Roundup
On August 27, PaperCut released an urgent security bulletin detailing two 0-day vulnerabilities in their PaperCut NG and PaperCut MF servers that are under active exploitation. The first vulnerability, CVE-2026-81578 allows for authentication bypass, which can then be followed up by exploiting the second vulnerability, CVE-2026-82078, to achieve remote code execution. PaperCut has updated the bulletin several times since the initial publication, including on September 1 when they published "Emergency Patch Release 3" which addresses bypasses and other issues from previous emergency patches.
These vulnerabilities affect all previous versions of PaperCut NG & MF. Administrators are urged to apply Emergency Patch 3 as soon as possible. Any environment with internet-facing PaperCut servers should review the extensive list of potential indicators of compromise highlighted in the bulletin here. As PaperCut vulnerabilities have been previously exploited by ransomware groups for widespread data theft, administrators should treat these vulnerabilities as urgent and remediate them as soon as possible.
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
https://thehackernews.com/2026/08/attackers-chain-two-papercut-flaws-to.html
SonicWall recently disclosed a pair of 0-day vulnerabilities that can be chained together to achieve remote code execution on affected devices. The first is tracked as CVE-2026-83548, a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface, allowing for unauthorized access. The second is tracked as CVE-2026-83549, a post-authentication OS command injection vulnerability allowing a remote attacker to execute arbitrary OS commands as administrator.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html
On September 1, ServiceNow published a support advisory detailing multiple maximum-severity flaws in their platform. The first is tracked as CVE-2026-18885, a code injection flaw in the ServiceNow Ai platform which allows an unauthenticated user to execute arbitrary code on the platform. The second is tracked as CVE-2026-18886, which is an improper access control flaw in the ServiceNow AI platform allowing an unauthenticated user to create or modify instance data, resulting in privilege escalation. Last is a vulnerability tracked as CVE-2026-74820, a SQL injection flaw in the ServiceNow AI platform allowing an unauthenticated user to execute arbitrary SQL statements on the system. The fixed release versions are shown below. Administrators are urged to apply the fix as soon as possible.
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html
As part of the September 2026 security updates, SAP disclosed CVE-2026-44756 (aka OVERPASS), a maximum-severity buffer overflow flaw in the Extended Passport Protocol (EPP) processing library. Successful exploitation of this vulnerability allows an unprivileged threat actor to run arbitrary commands with administrative privileges on the SAP host. Exploitation can be achieved over the SAP Internet Communication Manager (ICM), which is the networking component that connects the SAP NetWeaver Application Server to the internet via HTTP, HTTPS, and SMTP. The security updates also included fixes for 19 other flaws across SAP products. Administrators are urged to apply these fixes as soon as possbile.
N-able recently released "Hotfix 4" to address a new maximum-severity vulnerability in its N-central remote monitoring and management platform. Tracked as CVE-2026-86218, the vulnerability allows for pre-authenticated remote code execution. The flaw impacts all versions of on-prem N-central before version 2026.3.1.14. Administrators are urged to apply this latest hotfix as soon as possible.
https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/
https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
HPE recently released a support advisory detailing multiple vulnerabilities in ArubaOS-CX, including a critical unauthenticated remote code execution (RCE) flaw. Tracked as CVE-2026-73749, the vulnerability allows for an unauthenticated remote attacker to achieve RCE with "elevated privileges." The vulnerability affects the following versions:
On August 26, Ubiquiti published a security advisory bulletin addressing 22 security issues across a variety of their products. The advisory includes details for 3 maximum-severity vulnerabilities. The first, tracked as CVE-2026-77537, is an Improper Input Validation vulnerability in UniFi Protect Application that allows for command injection, affecting versions through 7.2.105. Second is a vulnerability tracked as CVE-2026-77550, which is a carriage return line feed (CRLF) injection flaw allowing for authentication bypass on UniFi OS devices, affecting versions prior to 5.1.37. Last is a command injection vulnerability in UniFi Talk Application (VoIP) systems. Tracked as CVE-2026-77554, it affects UniFi Talk Application prior to 5.3.2. Administrators are urged to apply the applicable updates as soon as possible.
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Visit our Cyber Threat Profile Blog for detailed intelligence profiles.
Visit our Beyond the Threat Feed Blog for more articles.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.