A ClickFix attack involving an intrusion in late September 2026 used social engineering, trusted Microsoft files and an encrypted Python tunnel to prepare Windows systems for further compromise. Defenders contained the intrusion before any ransomware payload was launched.
Forescout Vedere Labs first detailed the incident publicly on 14 October 2026. The techniques overlapped with activity previously associated with Vice Society and Rhysida ransomware, although researchers did not firmly attribute this intrusion to either operation.
How the ClickFix attack unfolded
The ClickFix attack began when a user encountered a deceptive prompt and was persuaded to run a supplied command. ClickFix lures commonly imitate verification processes or technical fixes, while the TerminalFix variation directs victims to Windows Terminal or PowerShell.
The command downloaded a ZIP archive containing three important components: a legitimate Microsoft-signed executable, a malicious dynamic link library and a batch script. Rather than exploiting a Windows vulnerability, the attackers relied on the user executing the command and on predictable Windows library loading behaviour.
When the trusted Microsoft program started, it loaded the malicious DLL stored beside it. This technique, known as DLL sideloading, lets attackers execute malicious code through a signed and apparently legitimate process. In related cases documented by Microsoft and Sophos, the signed executable was LockScreenContentServer.exe and the malicious library was named dui70.dll.
The accompanying script established persistence through Registry Run key entries and a scheduled task configured to execute hourly. These mechanisms allowed the infection chain to restart after a reboot and gave the operators repeated opportunities to reconnect.
Malicious code concealed as ordinary words
The sideloaded DLL executed the Lorem Ipsum loader. Forescout examined five Lorem Ipsum samples alongside 39 AxolotlLoader samples, identifying shared command traffic and differences in their implementation and delivery methods.
Lorem Ipsum concealed shellcode using a dictionary containing 260 random five-letter English words. At runtime, a lookup table converted the words back into executable bytes. Encoding instructions as ordinary text reduced the data’s apparent randomness, potentially making it less obvious to security products looking for high-entropy encrypted payloads.
Additional layers included XOR decoding and an embedded JPEG used as a decoy. The loader decoded its instructions in memory, restored parts of a Windows library from a clean disk copy and launched another instance of its legitimate host process. It then injected code into the new process and terminated the original instance.
A marker and mutex prevented multiple copies from running simultaneously. The overall design combined trusted binaries, in-memory execution and layered encoding to complicate analysis of the ClickFix attack.
Dead-drop resolution and disguised command traffic
The loader did not need to embed a permanent command and control address directly in its code. Instead, it could retrieve the current server location from a profile on a legitimate online forum, a method known as dead-drop resolution.
Previous analysis identified profiles on letsdiskuss dot com being used for this purpose. Separating the resolver from the actual command server allows operators to change infrastructure without replacing the malware already installed on an endpoint.
Command traffic could also be disguised as image content, including JFIF or PNG data with information appended to it. This made network communications resemble routine image transfers, although the underlying destination and traffic patterns could still reveal the activity.
ClickFix attack ended with an encrypted Python tunnel
After registering with its command infrastructure, the infection chain deployed a Python-based tunnelling client. The implant created a reverse proxy to attacker-controlled infrastructure over TLS on port 443, using an encrypted WebSocket channel.
This tunnel could carry arbitrary TCP traffic and provide continuing access to services inside the affected environment. Because port 443 is commonly used for encrypted web traffic, the connection could blend into normal network activity unless defenders inspected process behaviour, destinations and unusual long-lived sessions.
Closely matching TerminalFix campaigns also performed domain and Active Directory reconnaissance, including searches for administrators and domain trust relationships. Such information can help an attacker understand the network, identify privileged accounts and select systems for lateral movement.
In this incident, defenders disrupted the operation before ransomware execution. The result was therefore a contained intrusion and suspected ransomware staging event, not a confirmed ransomware deployment or data encryption incident.
Timeline of the 2026 ClickFix activity
-
4 May 2026: BlueVoyant published analysis of Lorem Ipsum delivered through trojanised Microsoft Teams installers. The campaign used forum profiles for dead-drop resolution and disguised command traffic as JFIF image data.
-
28 August 2026: Microsoft documented an active TerminalFix campaign using fake Cloudflare CAPTCHA pages, PowerShell commands, DLL sideloading, Registry and scheduled task persistence, Active Directory reconnaissance and a Python reverse tunnel.
-
30 September 2026: Sophos reported TerminalFix cases in which LockScreenContentServer.exe sideloaded dui70.dll to execute Lorem Ipsum. Researchers also observed dead-drop resolution and a Python tunnelling implant.
-
Late September 2026: The ClickFix attack later analysed by Forescout occurred and was contained before ransomware could run.
-
14 October 2026: Forescout published its comparative technical analysis and disclosed the late September intrusion.
Affected Windows systems and exploitation status
The activity affects Windows endpoints where a user can be induced to execute a Terminal or PowerShell command. There is no specific vulnerable Windows version or CVE associated with the campaign because the intrusion uses social engineering, scripts and DLL sideloading rather than exploiting a single software flaw.
The ClickFix attack technique is being actively used in the wild. Microsoft, Sophos and Forescout all observed closely matching activity during 2026. A proof of concept is not relevant because this is an operational intrusion chain rather than a newly disclosed vulnerability.
Lorem Ipsum has also appeared under or alongside the names AxolotlLoader and OAKGLINT in public malware references. Organisations should account for these names when searching intelligence platforms and security telemetry.
Why the ransomware connection requires caution
Forescout identified overlap with tradecraft previously attributed to Vice Society, an operation associated in earlier research with Rhysida ransomware. That history supports the assessment that the attackers were preparing access which could lead to ransomware.
However, overlapping tools and techniques do not prove who conducted this incident. Sophos has cautioned that TerminalFix is used across multiple campaigns, and no ransomware payload reached execution in the late September case. The most accurate description is a likely staging operation with an unconfirmed operator.
What organisations should check now
Defenders should prioritise evidence directly connected to this ClickFix attack chain rather than relying only on known file hashes or IP addresses, which attackers can change quickly.
-
Search for LockScreenContentServer.exe running with a nearby dui70.dll or other unexpected DLLs.
-
Review Registry Run keys and hourly scheduled tasks created around suspicious Terminal or PowerShell activity.
-
Investigate ZIP downloads followed by signed Microsoft binaries launching from user-writable directories.
-
Look for Python processes creating long-lived outbound WebSocket or TLS connections on port 443.
-
Review access to letsdiskuss dot com profiles and image-like responses containing appended data.
-
Treat identified endpoints as possible network pivot points and examine related authentication, reconnaissance and lateral movement activity.
Users should also be warned that legitimate CAPTCHA or verification pages do not normally require commands to be pasted into Windows Terminal or PowerShell. Rapid reporting of such prompts can help security teams interrupt the chain before persistent access is established.
Originally reported by cybersecuritynews.com.
