TerminalFix Campaign Uses PowerShell and DLL Sideloading to Establish Covert C2 Tunnels

This report details the TerminalFix (STAC4924) campaign observed since March 2026 that uses ClickFix-style lures to get victims to paste PowerShell into Windows Terminal, which downloads a ZIP containing a legitimate EXE and a weaponized dui70.dll for DLL sideloading; the sideloaded component executes a Lorem Ipsum shellcode loader (using English-word-encoded payloads) that resolves C2 via Letsdiskuss profiles, hides communications in JPEG-like POSTs, and ultimately deploys a Python-based client (client.py) that establishes encrypted WebSocket reverse tunnels to relay traffic into internal networks. Sophos links the campaign to earlier SEO-poisoned trojanized MSI distribution, BlueVoyant attributes the loader to Rapid Brigantine, and recommended mitigations include restricting PowerShell, enabling logging, monitoring for DLL sideloading and unexpected Python runtimes, and user training to reject pasted Terminal commands.