Daily Reading for 2026-08-29

TerminalFix Campaign

Microsoft Threat Intelligence details TerminalFix, a ClickFix-variant campaign that compromises websites to show a fake Cloudflare Turnstile CAPTCHA, tricking users into pasting a PowerShell command. That single lure fans out into a full multi-stage chain: a legitimate signed binary (LockScreenContentServer.exe) is abused to sideload a malicious dui70.dll, payloads are hidden in PNG pixels via steganography, and the implant does deep Active Directory reconnaissance before launching a Python reverse-tunnel C2 that proxies arbitrary TCP through an encrypted WebSocket back to attacker infrastructure. The danger is network-level, persistent access — compromised hosts become pivot points for lateral movement, credential theft, and ransomware. For defenders it is a stark reminder that social engineering plus commodity tooling can yield enterprise-wide network compromise from one paste.

Watch for:

• Fake Cloudflare Turnstile “verify you are human” overlays on any visited site, which silently copy a PowerShell command to the clipboard.
• USB/signed-binary DLL sideloading (LockScreenContentServer.exe pairing with dui70.dll) as an execution-evasion signature.
• Steganographic PNG download/staging plus dual persistence via Registry Run keys and 60-minute scheduled tasks.
• A second-stage file-watch command shell and a reverse WebSocket tunnel to attacker infrastructure (gitnow[.]dev:443), signalling persistent network proxying.

Wardley signals:

• Components — malicious PowerShell lure; fake Cloudflare Turnstile overlay; signed LockScreenContentServer.exe; sideloaded dui70.dll; steganographic PNG payload extraction; Active Directory reconnaissance tooling; Python reverse-tunnel C2 implant (client.py) over WebSocket; Registry Run keys / scheduled-task persistence.

• Evolution stage — ClickFix-style social-engineering lures are near Commodity (widely recycled kits); DLL sideloading (T1574.001) is a well-understood Commodity evasion technique; steganographic payload delivery is Custom (bespoke per campaign); the WebSocket reverse-tunnel C2 is earlier, Custom-to-Product and still iterating rapidly.

• Doctrine hits/misses — attackers “Exploit the landscape” by composing standard, available components and live within “There is no core” (no single weak point, just assembled tooling); defenders’ “Bias towards open” and transparency make the technique inventory publicly knowable, which the campaign weaponises.

• Climatic patterns — “Everything evolves through supply and demand competition” and “Commoditisation <> Centralisation” show attack tooling commoditising even as defenders centralise; “Competitors actions will change the game” as C2 and evasion iterate; “Evolution consists of multiple waves of diffusion with many chasms” fits recurring ClickFix copy-cats.

• Diffusion markers — copy-cat campaign proliferation (TerminalFix follows the ClickFix playbook); reuse of legitimate signed binaries as a spreading evasion practice; standardisation of social-engineering lures; rapid ecosystem re-use of reverse-tunnel and steganography techniques.

• TerminalFix campaign deploys a reverse tunnel through multistage intrusion

wardley-beta
%% 1. users: enterprise security analyst / network defender
%% 2. need: detect and contain TerminalFix/ClickFix-style multi-stage intrusions before network-level compromise
%% 3. capabilities: monitor endpoints for malicious execution, spot lateral/tunnel traffic, guide containment
%% 4. components: EDR telemetry, DLL-sideload detection, reverse-tunnel network visibility, threat intel, IR playbook
%% 5. maturity: EDR near-Commodity; sideload detection Product; net tunnel visibility Commodity; threat intel Product; IR playbook Custom
%% 6. managed by: security-ops analysts, EDR vendors, Microsoft Threat Intelligence
anchor defendNeed [0.95, 0.93]
component edrTelemetry [0.68, 0.72]
component sideloadDetection [0.50, 0.62]
component netTunnelVisibility [0.76, 0.58]
component threatIntel [0.48, 0.44]
component irPlaybook [0.30, 0.34]
edrTelemetry -> defendNeed
sideloadDetection -> edrTelemetry
netTunnelVisibility -> edrTelemetry
threatIntel -> sideloadDetection
irPlaybook -> defendNeed
evolve edrTelemetry 0.85

AI-Accelerated Exploit Discovery

Anil Madhavapeddy reports that OCaml projects now see attempts to exploit a disclosed vuln within roughly ten minutes of a patch being floated for discussion, and rclone’s Nick Craig-Wood confirms the pattern: security disclosures jumped from about 20 in the first ten years to over 40 in the last month. The mechanism is AI coding agents — capable of finding an exploit from just a rumour of a bug — plus automated watchers probing public repositories as soon as a commit appears. Because a fix can become a working exploit in minutes, traditional coordinated-disclosure embargos (days of quiet, then a release) no longer hold; GitHub’s CVE assignment alone has stretched from 2–3 days to 3–4 weeks. The takeaway is not just speed, but a broken assumption at the core of open-source vulnerability handling, and a call for new processes.

Watch for:

• The shrinking window between a patch discussion and first probe/exploit attempt on public repositories.
• Open-source maintainers explicitly adopting AI tools to triage and fix incoming disclosures, as rclone does.
• Growth in the CVE/advisory assignment backlog and “CVE-PENDING” releases, signalling an overwhelmed coordination layer.
• New or revised embargo/coordination policies responding to sub-hour exploitation timelines.

Wardley signals:

• Components — AI coding agents (e.g. Claude, DeepSeek V4 Pro); OCaml; rclone; GitHub security advisories and CVE assignment; coordinated vulnerability disclosure (embargo process); automated repository watchers/probers; AI-assisted triage and patching tools.

• Evolution stage — AI coding agents are Custom-to-Product (improving fast, not yet a utility); automated exploit generation from a bug rumour is Genesis-to-Custom (novel, uncertain, high value); the CVE/embargo coordination process is Product-to-Commodity but becoming a bottleneck, its inertia outpaced by exploit speed.

• Doctrine hits/misses — “Bias towards the new” as communities move to agent-assisted triage; “Embrace uncertainty” in the face of unpredictable exploit timing; “Manage inertia” hit hard because legacy embargo/CVE durations can no longer keep pace with the new threat speed (an inertia miss).

• Climatic patterns — “Change is not always linear (discontinuous & exponential)” fits the jump to minutes-scale exploitation; “Efficiency enables innovation (componentisation effect)” as cheap agents commoditise exploit discovery; “Creative Destruction” of established disclosure practice.

• Diffusion markers — rapid, exponential spread of agent-assisted exploitation; a many-fold rise in security disclosures (rclone 20 → 40/month); automated watchers probing repos as soon as patches appear; maintainers standardising on AI triage — early signs of a practice diffusing across the ecosystem.

• Just a rumour of a bug is enough to find a security exploit these days

wardley-beta
%% 1. users: open-source maintainers; security-coordination bodies (CVE/embargo)
%% 2. needs: keep projects safe from fast agent-driven exploits; coordinate disclosure before exploitation
%% 3. capabilities: detect bug rumours, triage incoming disclosures, generate/patch fixes, coordinate release
%% 4. components: AI coding agents, automated repo watchers, AI-assisted triage, disclosure/embargo process, patch release
%% 5. maturity: AI agents Custom; automated watchers Genesis-Custom; vuln triage Custom; disclosure Process; patch release Product
%% 6. managed by: maintainers (e.g. rclone), GitHub / CVE coordinator authorities
anchor maintainer [0.95, 0.93]
anchor coordinator [0.95, 0.80]
component aiCodingAgents [0.28, 0.55]
component automatedWatchers [0.30, 0.45]
component vulnTriage [0.42, 0.62]
component disclosureProcess [0.55, 0.78]
component patchRelease [0.62, 0.85]
aiCodingAgents -> maintainer
automatedWatchers -> aiCodingAgents
vulnTriage -> maintainer
disclosureProcess -> coordinator
patchRelease -> maintainer
evolve disclosureProcess 0.82