Date: 10/06/2026
Severity: High
Summary
In August 2026, analysts investigated MDR cases involving ClickFix-style lures that deployed a Python-based tunneling implant. Unlike traditional ClickFix attacks, the lures instructed victims to open Windows Terminal, a technique known as TerminalFix. TerminalFix is not tied to a specific threat actor or campaign and has been observed across multiple malicious campaigns in 2026. Analysts identified Lorem Ipsum Loader, along with C2 infrastructure, persistence methods, and DLL sideloading activity. These findings linked the intrusions to a broader campaign active since at least March 2026, tracked as STAC4924.
Indicators of Compromise (IOC) List
Domains/URLs | https://letsdiskuss.com/user/dhhsys6674dhhsys667476001 webfeedonline.com fish-planet.online forest-pet.com yellow-tree.online cave-discovery.online bestsocialmedianewspapper.com fixdocumentview.com offlineupdater.com opendocumentnowforfree.com openlockeddocuments.com ourpersonalsecurity.com viewpublicdocuments.com yourappdoctor.com yourprettylittlepicture.com firstapphelp.com goodfoodrecipients.com languageupgrader.com biblegodlike.com valueurban.com graburban.com documentthis.art peekyourphoto.com topphotoalbum.com newpopularimages.com opendocumentonline.com editdocumentfree.com bestpopularimages.com documentsphotos.com openpdfanywhere.com openandopen.com lookforimages.com freeshareyourimage.com freecatimages.com imageuploaderfree.com sharingclick.com searchdocumentsfree.com openanyworddocument.com kittyfreespace.com oceansecretlife.com grapesinlife.com capturethes.com loginrestforest.com reeeeealy.com semigoddess.com imagethere.info placebetweenphotos.us openimagesworld.us ghostproc.com assetsoftgo.com autorelaylab.com adstatli.com metricgw.com platformco-hub.com swiftcurrento.net cronverta.net |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "editdocumentfree.com" or url like "editdocumentfree.com" or siteurl like "editdocumentfree.com" or domainname like "loginrestforest.com" or url like "loginrestforest.com" or siteurl like "loginrestforest.com" or domainname like "yourappdoctor.com" or url like "yourappdoctor.com" or siteurl like "yourappdoctor.com" or domainname like "viewpublicdocuments.com" or url like "viewpublicdocuments.com" or siteurl like "viewpublicdocuments.com" or domainname like "cave-discovery.online" or url like "cave-discovery.online" or siteurl like "cave-discovery.online" or domainname like "semigoddess.com" or url like "semigoddess.com" or siteurl like "semigoddess.com" or domainname like "openanyworddocument.com" or url like "openanyworddocument.com" or siteurl like "openanyworddocument.com" or domainname like "valueurban.com" or url like "valueurban.com" or siteurl like "valueurban.com" or domainname like "platformco-hub.com" or url like "platformco-hub.com" or siteurl like "platformco-hub.com" or domainname like "fixdocumentview.com" or url like "fixdocumentview.com" or siteurl like "fixdocumentview.com" or domainname like "grapesinlife.com" or url like "grapesinlife.com" or siteurl like "grapesinlife.com" or domainname like "openimagesworld.us" or url like "openimagesworld.us" or siteurl like "openimagesworld.us" or domainname like "documentsphotos.com" or url like "documentsphotos.com" or siteurl like "documentsphotos.com" or domainname like "firstapphelp.com" or url like "firstapphelp.com" or siteurl like "firstapphelp.com" or domainname like "swiftcurrento.net" or url like "swiftcurrento.net" or siteurl like "swiftcurrento.net" or domainname like "openandopen.com" or url like "openandopen.com" or siteurl like "openandopen.com" or domainname like "searchdocumentsfree.com" or url like "searchdocumentsfree.com" or siteurl like "searchdocumentsfree.com" or domainname like "topphotoalbum.com" or url like "topphotoalbum.com" or siteurl like "topphotoalbum.com" or domainname like "languageupgrader.com" or url like "languageupgrader.com" or siteurl like "languageupgrader.com" or domainname like "newpopularimages.com" or url like "newpopularimages.com" or siteurl like "newpopularimages.com" or domainname like "openlockeddocuments.com" or url like "openlockeddocuments.com" or siteurl like "openlockeddocuments.com" or domainname like "offlineupdater.com" or url like "offlineupdater.com" or siteurl like "offlineupdater.com" or domainname like "opendocumentnowforfree.com" or url like "opendocumentnowforfree.com" or siteurl like "opendocumentnowforfree.com" or domainname like "yourprettylittlepicture.com" or url like "yourprettylittlepicture.com" or siteurl like "yourprettylittlepicture.com" or domainname like "ourpersonalsecurity.com" or url like "ourpersonalsecurity.com" or siteurl like "ourpersonalsecurity.com" or domainname like "reeeeealy.com" or url like "reeeeealy.com" or siteurl like "reeeeealy.com" or domainname like "forest-pet.com" or url like "forest-pet.com" or siteurl like "forest-pet.com" or domainname like "peekyourphoto.com" or url like "peekyourphoto.com" or siteurl like "peekyourphoto.com" or domainname like "assetsoftgo.com" or url like "assetsoftgo.com" or siteurl like "assetsoftgo.com" or domainname like "imageuploaderfree.com" or url like "imageuploaderfree.com" or siteurl like "imageuploaderfree.com" or domainname like "https://letsdiskuss.com/user/dhhsys6674dhhsys667476001" or url like "https://letsdiskuss.com/user/dhhsys6674dhhsys667476001" or siteurl like "https://letsdiskuss.com/user/dhhsys6674dhhsys667476001" or domainname like "metricgw.com" or url like "metricgw.com" or siteurl like "metricgw.com" or domainname like "ghostproc.com" or url like "ghostproc.com" or siteurl like "ghostproc.com" or domainname like "autorelaylab.com" or url like "autorelaylab.com" or siteurl like "autorelaylab.com" or domainname like "bestsocialmedianewspapper.com" or url like "bestsocialmedianewspapper.com" or siteurl like "bestsocialmedianewspapper.com" or domainname like "opendocumentonline.com" or url like "opendocumentonline.com" or siteurl like "opendocumentonline.com" or domainname like "goodfoodrecipients.com" or url like "goodfoodrecipients.com" or siteurl like "goodfoodrecipients.com" or domainname like "sharingclick.com" or url like "sharingclick.com" or siteurl like "sharingclick.com" or domainname like "cronverta.net" or url like "cronverta.net" or siteurl like "cronverta.net" or domainname like "oceansecretlife.com" or url like "oceansecretlife.com" or siteurl like "oceansecretlife.com" or domainname like "graburban.com" or url like "graburban.com" or siteurl like "graburban.com" or domainname like "bestpopularimages.com" or url like "bestpopularimages.com" or siteurl like "bestpopularimages.com" or domainname like "webfeedonline.com" or url like "webfeedonline.com" or siteurl like "webfeedonline.com" or domainname like "documentthis.art" or url like "documentthis.art" or siteurl like "documentthis.art" or domainname like "biblegodlike.com" or url like "biblegodlike.com" or siteurl like "biblegodlike.com" or domainname like "openpdfanywhere.com" or url like "openpdfanywhere.com" or siteurl like "openpdfanywhere.com" or domainname like "freecatimages.com" or url like "freecatimages.com" or siteurl like "freecatimages.com" or domainname like "placebetweenphotos.us" or url like "placebetweenphotos.us" or siteurl like "placebetweenphotos.us" or domainname like "fish-planet.online" or url like "fish-planet.online" or siteurl like "fish-planet.online" or domainname like "yellow-tree.online" or url like "yellow-tree.online" or siteurl like "yellow-tree.online" or domainname like "capturethes.com" or url like "capturethes.com" or siteurl like "capturethes.com" or domainname like "lookforimages.com" or url like "lookforimages.com" or siteurl like "lookforimages.com" or domainname like "kittyfreespace.com" or url like "kittyfreespace.com" or siteurl like "kittyfreespace.com" or domainname like "imagethere.info" or url like "imagethere.info" or siteurl like "imagethere.info" or domainname like "freeshareyourimage.com" or url like "freeshareyourimage.com" or siteurl like "freeshareyourimage.com" or domainname like "adstatli.com" or url like "adstatli.com" or siteurl like "adstatli.com" |
Reference:
https://www.sophos.com/en-us/blog/terminalfix-and-lorem-ipsum-loader-enable-covert-tunneling