The Evolution of Stealth: Decoding the ‘TerminalFix’ Campaign and the Rise of STAC4924

In the ever-evolving landscape of cyber warfare, threat actors are increasingly abandoning high-effort, sophisticated exploits in favor of "social engineering-first" approaches. A prime example of this shift is the emergence of "TerminalFix," a cunning variation of the well-known ClickFix social engineering lure. First identified by Sophos analysts in August 2026, this technique represents a significant pivot in how attackers compromise Windows environments, moving away from simple dialog boxes toward direct terminal-based manipulation.

Sophos has been tracking the infrastructure and tactics associated with these intrusions under the designation STAC4924. This campaign, which has demonstrated remarkable resilience and adaptability throughout 2026, highlights the growing threat of Python-based tunneling implants and the clever use of steganography to mask malicious Command and Control (C2) traffic.

---

The Core of the Threat: From ClickFix to TerminalFix

For years, "ClickFix" lures have plagued users by instructing them to open the Windows "Run" dialog box to execute a malicious command. TerminalFix updates this playbook. Instead of a Run box, the lures prompt users to open a Windows Terminal window, adding a veneer of technical legitimacy that can trick even security-conscious employees.

Once the user is convinced to open the terminal and paste the provided command, they inadvertently trigger a PowerShell script. This script initiates a multi-stage infection chain that downloads a ZIP archive containing a legitimate Windows executable, a malicious DLL, and a batch script. The batch script serves as the engine for the attack, establishing persistence and launching the secondary payloads that facilitate the intruder’s long-term access to the network.

---

A Chronology of Deception: The STAC4924 Timeline

The STAC4924 campaign did not appear overnight. Sophos analysts, by correlating data from multiple Managed Detection and Response (MDR) cases, have mapped a two-phase evolution that spans the better part of 2026.

Phase One: The MSI Era (March – May 2026)

The campaign’s origins can be traced back to at least March 2026. During this initial phase, the threat actors relied heavily on Search Engine Optimization (SEO) poisoning. By creating malicious websites that mimicked legitimate software repositories, the attackers successfully distributed trojanized Microsoft Teams MSI installers. These installers were signed with fraudulently obtained certificates, allowing them to bypass basic security warnings. This phase utilized a multi-stage PowerShell loader that communicated with C2 infrastructure and leveraged profiles on the platform letsdiskuss[.]com as dead-drop resolvers.

The Turning Point: May 2026

In late May, a major disruption occurred: Microsoft executed a targeted takedown of a prominent malware-signing service. This service had been the backbone of the attackers’ ability to present "trusted" software. Faced with the loss of their primary delivery mechanism, the threat actors did not retreat. Instead, they demonstrated operational agility by transitioning away from signed MSI installers to the TerminalFix social engineering lures.

Phase Two: The TerminalFix and DLL Sideloading Era (June – September 2026)

From June through September, the campaign entered its current phase. The focus shifted to DLL sideloading and more advanced evasion techniques. By using legitimate binaries like LockScreenContentServer.exe to load malicious DLLs (such as dui70.dll), the attackers effectively "hid in plain sight." This period also saw the introduction of the Lorem Ipsum Loader, a shellcode-based tool that masks its intent by using human-readable English words instead of raw binary, thwarting many entropy-based security detections.

---

Supporting Data: Infrastructure and Tradecraft

The sophistication of STAC4924 lies in its post-compromise playbook. The campaign utilizes a highly modular structure designed to maintain persistence and evade detection.

The Lorem Ipsum Loader

The loader, first documented by BlueVoyant in February 2026, is a cornerstone of the operation. It is named for its unique obfuscation method: it stores shellcode bytes as English words. A lookup table within the code maps these words back to hexadecimal values, effectively hiding the malicious code from static analysis tools that look for high-entropy binary blobs.

Steganography in C2

Communication between the infected host and the attacker’s C2 server is equally inventive. The loader sends HTTP POST requests that, to the untrained eye, appear to be innocuous JPEG image files. However, the malware hides encrypted data within these images. By extracting and decoding this data, the attacker sends instructions to the host while blending in with standard web traffic, making traditional network-based blocking extremely difficult.

Python-based Tunneling

Once the host is compromised, the malware deploys a portable Python runtime to the UsersPublicindigo directory. This environment is used to execute client.py, a custom tunneling implant. This implant establishes an encrypted WebSocket connection to an attacker-controlled server. Each connection is assigned a unique UUID, allowing the threat actors to manage hundreds of compromised hosts simultaneously. This tunnel essentially turns the victim’s machine into a proxy, enabling the attackers to relay traffic through the internal network and access resources behind the corporate firewall.

---

Attribution and the "GOLD VICTOR" Connection

The technical indicators—specifically the unique UUID callback structure, the use of letsdiskuss[.]com as a dead-drop, and the consistent DLL sideloading patterns—provide strong evidence that these two phases are the work of a single, coordinated actor.

BlueVoyant has attributed the Lorem Ipsum Loader to the cybercriminal entity Rapid Brigantine, also tracked by the Sophos Counter Threat Unit (CTU) as GOLD VICTOR. This group has a documented history of deploying high-impact ransomware, including the Vice Society and Rhysida families. While Sophos researchers have yet to observe the final stage of this specific campaign involving data encryption or ransomware deployment, the presence of such a high-tier actor suggests that STAC4924 is likely a precursor to a more destructive phase.

---

Implications for Corporate Security

The implications of the STAC4924 campaign are significant for security teams. The transition from technical exploits to social engineering lures like TerminalFix means that the human element remains the weakest link in the security chain.

The "Sideloading" Problem

The list of DLL sideloading pairings observed in this campaign is extensive. By abusing trusted binaries like wuauclt.exe, certenrollctrl.exe, and phoneactivate.exe, the attackers neutralize the effectiveness of allow-listing policies that only look at file names or certificates. Organizations must move toward behavioral-based detection that flags the activity—such as a legitimate process suddenly loading an unauthorized DLL—rather than relying solely on file reputation.

The Need for Proactive Hunting

Because the attackers use legitimate web platforms (like letsdiskuss.com and python.org) and common protocols (HTTP/HTTPS), perimeter firewalls and traditional antivirus solutions are often insufficient. Security teams must prioritize:

1. Endpoint Detection and Response (EDR): Monitoring for unauthorized PowerShell executions and unusual child processes.
2. Network Traffic Analysis: Investigating outbound traffic to non-standard or suspicious image-hosting services.
3. Employee Education: Specifically training staff on the dangers of "TerminalFix" and the risks of executing commands provided in emails or web lures.

---

Official Responses and Remediation

Sophos has released a comprehensive set of Indicators of Compromise (IoCs) to help organizations identify and remediate infections. Given the sheer scale of the campaign, they advise that all organizations audit their UsersPublic folders for unauthorized Python runtimes and check for suspicious scheduled tasks or auto-run entries that masquerade as Microsoft components.

As the industry continues to grapple with the "TerminalFix" phenomenon, the primary takeaway is clear: the era of "set it and forget it" security is over. Threat actors are now actively mimicking the administrative tools that IT departments use to manage networks. In this environment, the ability to distinguish between a legitimate system update and a malicious sideloading operation is not just an advantage—it is a requirement for survival.

The full list of IoCs, including file hashes, C2 domains, and specific PowerShell command signatures, is available in the SophosLabs GitHub repository. Organizations are encouraged to ingest this data immediately to harden their defenses against the ongoing STAC4924 campaign.