> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # TerminalFix: PNG Steganography - URL: https://f4n6.co.uk/security-feed/terminalfix-png-steganography/ - Published: 2026-09-21T15:03:36.000Z - Updated: 2026-09-21T15:03:36.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft Threat Intelligence has documented a ClickFix variant it calls TerminalFix, in which compromised websites display a fake Cloudflare Turnstile CAPTCHA overlay that tricks users into pasting a malicious PowerShell command into Windows Terminal or PowerShell. The chain delivers a multi-stage payload: DLL sideloading via the signed binary LockScreenContentServer.exe loading a malicious dui70.dll, payloads extracted from PNG images using full-bit steganography, dual persistence through Registry Run keys and scheduled tasks, Active Directory reconnaissance, and a Python-based reverse-tunnel implant that multiplexes arbitrary TCP traffic over an encrypted WebSocket channel on port 443\. SANS ISC handler Didier Stevens independently confirmed the steganographic mechanism and carved the embedded PE from the first PNG (sha256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe). The bottom-line risk for EMEA financial services is that a single user action on a workstation converts it into a network-level pivot point into the internal environment, with Microsoft explicitly warning that the hands-on-keyboard phase that typically follows includes privilege escalation, disabling of security controls, data exfiltration, and ransomware. No verified reference data resolved for this item, so no CVSS, CISA-KEV, or MITRE attribution claims are made here; attribution is unconfirmed and Microsoft declined to identify the actor when asked by The Register. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The reverse-tunnel implant gives an attacker persistent, network-level proxy access through a compromised host, and Microsoft assesses the typical follow-on phase includes data exfiltration and ransomware; a confirmed compromise of this kind on a financial entity's workstation is a candidate major incident, not a routine malware detection. | If a client confirms TerminalFix compromise, run the Art. 19 classification and reporting workflow against the incident record rather than closing it as an endpoint detection; document the tunnel exposure and reconnaissance findings in the report package. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The campaign is a named, publicly documented cyber threat with a defined IOC set and hunting guidance from Microsoft; entities tracking threat intelligence for classification purposes have a concrete, dated threat to classify against. | Add TerminalFix to the internal threat taxonomy and classify any related detections using the Art. 18 criteria, so that borderline cases feed the Art. 19 decision consistently. | | NIS2 Art. 23: incident reporting obligations | For in-scope financial entities in NIS2 member states, the same confirmed-compromise trigger (persistent reverse tunnel plus AD reconnaissance on a domain-joined host) engages the Art. 23 assessment of whether the incident meets the significant-incident threshold. | Trigger the Art. 23 assessment clock on any confirmed TerminalFix execution, and preserve the technical evidence (scheduled task, Run key, extracted DLL, tunnel process) the assessment and any authority follow-up will need. | ## 3\. Technical analysis & attack chain Confirmed steps, drawn from the Microsoft blog and corroborated by The Register, Malwarebytes, and the SANS ISC analysis: 1. Initial access. A compromised website displays a fake Cloudflare Turnstile CAPTCHA overlay with a Cloudflare logo and a "verify you are human" checkbox. Clicking it copies a malicious command to the clipboard, and on-page instructions tell the user to paste it into Windows Terminal or PowerShell. This is the TerminalFix distinction from classic ClickFix: targeting Terminal or PowerShell rather than the Run dialog increases the chance that complex multi-line scripts execute. 2. First-stage PowerShell. The pasted command runs a hidden PowerShell script that prints a fake "Starting Cloudflare verification..." message, downloads a ZIP archive from attacker-controlled infrastructure, extracts it to C:\\ProgramData, and silently launches a batch file, 1.bat. 3. DLL sideloading. 1.bat executes LockScreenContentServer.exe, a legitimate signed Microsoft binary, which loads the co-located malicious dui70.dll (masquerading as the Windows DirectUI Engine). 4. Steganographic payload retrieval. The sideloaded DLL runs a second PowerShell script that downloads three PNG images from attacker domains. The script reads the pixel data: the first eight bytes of the raw bitmap specify the embedded file's length (little-endian), and the remaining data is carved out. Image one yields an embedded PE (49,720 bytes); images two and three each yield one half of the malicious DLL, which are concatenated on disk. The source images are deleted after extraction to reduce forensic artifacts. 5. Persistence. Redundant persistence via HKCU Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes, surviving reboots. 6. Reconnaissance. System information collection across English, Spanish, and German language configurations; domain trust enumeration; domain admin discovery; Active Directory user and computer searches, including harvesting of user description fields; and ping sweeps against named servers matching common infrastructure roles (domain controllers, databases, backup, gateways, mail systems). 7. Command loop. A persistent PowerShell file-watch loop monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. 8. Reverse tunnel. A Python-based C2 implant tunnels arbitrary TCP traffic back through an encrypted WebSocket channel to attacker infrastructure, outbound on port 443 so it passes through typical firewall policy. The tunnel is multiplexed: several separate connections (file server, database, another workstation) can run through the single channel simultaneously, turning the host into a stepping stone into the rest of the network. Steganographic mechanism, confirmed by SANS ISC analysis of the first PNG (sha256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe): the file is a structurally valid PNG with the expected header and exactly the three chunks of a minimal PNG (IHDR, IDAT, IEND), no appended data, and no metadata chunk that could carry a payload. It is 111 scanlines by 112 columns, 8-bit colour type 6 (RGBA), so 448 bytes per scanline. pngdump.py decompresses the IDAT without error and all scanline filters are valid. The payload therefore hides in the pixel values themselves. After undoing the per-scanline filters (the first scanline uses filter type 01, SUB), the raw bitmap begins with an 8-byte little-endian length field (49720) followed by the PE file, evidenced by MZ, .text, .data strings and the DOS stub "This program ..." in the raw data. Two details matter for detection engineering. First, the actors used all available bits, not least-significant-bit embedding, so the rendered image is visually destroyed noise rather than a plausible picture; a PNG that renders as noise is itself a signal. Second, because the payload occupies the full IDAT, the file still parses as a valid PNG, so file-type validation alone will not flag it. Scope caveats. Microsoft states it did not observe the downstream actions (privilege escalation, disabling security controls, exfiltration, ransomware) in the analyzed chain; those are assessed as the typical follow-on phase, not observed fact. Attribution is unconfirmed: Microsoft declined to answer The Register's questions on which actor is responsible, and no MITRE actor profile exists in the verified reference data for this item. The specific attacker domains, the ZIP download URL, the scheduled task names, and the Run key value names are not present in the provided source material; the Microsoft blog contains a fuller IOC set that we do not have in hand, and the IOC table below reflects only what the provided sources contain. The SANS IOC set for the two remaining PNGs (the DLL halves) was shared privately with the handler and their hashes are not published in the diary entry. ## 4\. Mitigation & containment P1, within 24 hours: - Hunt for the confirmed artefacts: the file names LockScreenContentServer.exe, dui70.dll, and 1.bat anywhere on endpoints, but treat them as names only since the underlying binaries are per-sample; the one hard pivot is the PNG sha256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe. Any hit means the steganographic stage ran. - Search for the persistence pair: HKCU Run keys and scheduled tasks whose action re-launches LockScreenContentServer.exe on a 60-minute interval. Delete both on any hit; removing only one leaves the redundant channel. - On any confirmed compromise, treat the host as a network pivot: isolate it, then investigate for lateral movement and credential exposure, per Microsoft's explicit guidance. Pull the AD reconnaissance footprint (trust enumeration, domain admin discovery, user description harvesting, ping sweeps against named servers) from DC and EDR logs to scope what the actor mapped. - Block and sinkhole the attacker domains once identified from proxy or EDS logs on affected hosts; the sources confirm the domains exist but do not name them, so this step depends on retrieving the Microsoft IOC list. P2, within 72 hours: - Review outbound WebSocket traffic on port 443 from workstations for long-lived, low-volume connections consistent with the multiplexed tunnel; the implant is Python-based, so also look for unexpected Python processes or packaged Python executables on user workstations. - Check C:\\ProgramData for the extraction directory and for the file-watch loop's command text file and output file; the exact names are not in the provided sources, so hunt for recently created text files that a PowerShell process reads repeatedly. - Apply application control or WDAC to block execution of LockScreenContentServer.exe outside its legitimate Windows path, which breaks the sideloading host regardless of payload. - Brief service desk and staff: a real CAPTCHA never asks the user to open Run, Terminal, Command Prompt, or PowerShell and paste a command. Any user report of a Cloudflare verification prompt that did should be treated as a probable compromise and triaged as P1. P3, within 7 days: - Restrict PowerShell for standard users (Constrained Language Mode or script block logging with transcription) so multi-line pasted scripts cannot run unimpeded; script block logging will capture the fake "Starting Cloudflare verification..." string and the Invoke-Expression command loop. - Deploy the YARA and Sigma rules in section 6 to scanning and SIEM pipelines. - Review whether clipboard-write events from web content are monitored; Malwarebytes notes its Browser Guard extension warns on clipboard writes, and macOS Tahoe 26.4 Terminal warns on pasting browser-copied text, which is the class of control worth replicating on Windows estates. - If a compromise is confirmed, complete the DORA Art. 19 / NIS2 Art. 23 assessment with the evidence preserved in P1. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ---------------------------------------------------------------- | ---------- | ------------------------------------------------------------- | | sha256 | f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe | high | SANS ISC (handler-confirmed, shared by Microsoft researchers) | | filename | LockScreenContentServer.exe | high | Microsoft, The Register, SANS ISC | | filename | dui70.dll | high | Microsoft, The Register | | filename | 1.bat | medium | The Register (single detailed source for the batch file name) | | filepath | C:\\ProgramData (ZIP extraction and payload staging) | high | Microsoft, The Register | The hash above is the only atomic network-independent indicator in the provided sources. The attacker domains, C2 URLs, and the hashes of the two DLL-half PNGs and the extracted DLL are not present in this material; the Microsoft blog's IOC list is the authoritative source for those and should be retrieved before enforcement. The filename and filepath rows are single-campaign observations, not unique indicators, and should be used for triage rather than blocking. ```iocs sha256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe filename LockScreenContentServer.exe filename dui70.dll filename 1.bat filepath C:\ProgramData ``` Behavioural indicators: | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | ---------- | | PowerShell printing "Starting Cloudflare verification..." then downloading a ZIP to C:\\ProgramData | PowerShell script block logging, EDR process telemetry | high | | Scheduled task re-executing LockScreenContentServer.exe every 60 minutes, paired with an HKCU Run key | Task Scheduler event logs (4698/4699/4700/4701), registry auditing | high | | PowerShell downloading three PNGs, then deleting the source images immediately after extraction | EDR file operations, proxy logs | high | | PowerShell file-watch loop reading a text file and passing content to Invoke-Expression, writing results to an output file | PowerShell script block logging, EDR | high | | Long-lived encrypted WebSocket connections outbound on 443 carrying multiplexed TCP sessions | NetFlow, proxy, EDR network telemetry | medium | | Domain trust enumeration, domain admin discovery, AD user description harvesting, ping sweeps against named servers | DC audit logs, EDR | high | | PNG files that render as visual noise (full-bit steganography destroys the image) | mail/web gateway image analysis, user reports | medium | ## 6\. Detection YARA rule built from the confirmed artefacts: the sideloaded DLL name, the batch file name, the fake verification string, and the steganographic length-field structure. Note the strings below are threat artefacts (file names used by the chain, the social-engineering string printed by the first-stage script); the PNG hash is included as a direct check. ```yara rule TerminalFix_ClickFix_Stego_Chain { meta: author = "Adverse Trace" date = "2026-09-21" reference = "https://isc.sans.edu/diary/rss/33318" description = "Detects TerminalFix campaign artefacts: fake Cloudflare verification PowerShell, sideloaded dui70.dll, 1.bat launcher, and the confirmed stego PNG sample" strings: $png_hash = { f5 f1 eb 6d 43 dd 61 d5 b0 69 c2 50 e5 c6 66 38 4f 74 17 d0 c9 50 14 77 3b f9 ed f8 ff 13 be be } $s1 = "Starting Cloudflare verification" ascii $s2 = "dui70.dll" ascii $s3 = "LockScreenContentServer.exe" ascii $s4 = "1.bat" ascii $s5 = "Invoke-Expression" ascii condition: uint16(0) == 0x4d5a or uint32(0) == 0x474e5089 or filesize < 200KB ? false // placeholder removed below } ``` Correction: the condition above must be valid YARA. Use this rule instead: ```yara rule TerminalFix_ClickFix_Stego_Chain { meta: author = "Adverse Trace" date = "2026-09-21" reference = "https://isc.sans.edu/diary/rss/33318" description = "Detects TerminalFix campaign artefacts: fake Cloudflare verification PowerShell, sideloaded dui70.dll, 1.bat launcher, and the confirmed stego PNG sample" strings: $png = { f5 f1 eb 6d 43 dd 61 d5 b0 69 c2 50 e5 c6 66 38 4f 74 17 d0 c9 50 14 77 3b f9 ed f8 ff 13 be be } $verify = "Starting Cloudflare verification" ascii $dui = "dui70.dll" ascii $lscs = "LockScreenContentServer.exe" ascii $bat = "1.bat" ascii $iex = "Invoke-Expression" ascii condition: $png or 3 of ($verify, $dui, $lscs, $bat, $iex) } ``` Sigma rule for the persistence and execution behaviours: ```yaml title: TerminalFix scheduled task or Run key persistence via LockScreenContentServer.exe id: 7c1f2a34-9b8e-4d5a-b6f0-1e2d3c4b5a69 status: experimental description: Detects the TerminalFix persistence mechanism, a scheduled task or HKCU Run key that re-executes LockScreenContentServer.exe every 60 minutes. references: - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ - https://isc.sans.edu/diary/rss/33318 author: Adverse Trace date: 2026-09-21 logsource: product: windows category: process_creation detection: selection_task: Image|endswith: '\schtasks.exe' CommandLine|contains: 'LockScreenContentServer.exe' selection_run_key: TargetFilename|contains: '\Software\Microsoft\Windows\CurrentVersion\Run' condition: 1 of selection_* falsepositives: - Legitimate use of LockScreenContentServer.exe in its proper Windows context; verify the file path is not the Windows system location level: high ``` ## 7\. Sources - SANS Internet Storm Center, Didier Stevens, "TerminalFix: PNG Steganography", https://isc.sans.edu/diary/rss/33318, 2026-09-21 - Microsoft Threat Intelligence, "TerminalFix campaign deploys a reverse tunnel through multistage intrusion", https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/, 2026-08-28 - The Register, "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines", https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480, 2026-08-31 - Malwarebytes Labs, "TerminalFix looks like ClickFix, but delivers a very different payload", https://www.malwarebytes.com/blog/news/2026/09/terminalfix-looks-like-clickfix-but-delivers-a-very-different-payload, 2026-09 - The Hacker News, "TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor", https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html, 2026-08 - Dark Reading, "'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks", https://www.darkreading.com/threat-intelligence/terminalfix-campaign-weaponizes-powershell-enterprise-attacks, 2026-08 ## 8\. Adverse Trace position We assess TerminalFix as a high-impact threat to EMEA financial services despite the absence of a CVSS score, because the risk is not a vulnerability to patch but a social-engineering chain that converts one user action into persistent, multiplexed network access; the steganographic delivery defeats file-type inspection, the signed sideloading host defeats naive trust checks, and the 443 WebSocket tunnel defeats port-based egress controls. The technical mechanism is well corroborated across Microsoft, SANS ISC, The Register, and Malwarebytes, but two elements are single-sourced or incomplete in the material we hold: the batch file name 1.bat rests on The Register's account alone, and the attacker domains, C2 infrastructure, and the remaining sample hashes sit in Microsoft's IOC list, which we have not yet ingested; verify against that list before enforcement. Attribution is unconfirmed and we will not speculate. We will retrieve the full Microsoft IOC set and the SANS shared PNG samples, expand the detection package with the additional hashes and domains, and issue a revision if the campaign shows confirmed financial-sector victims or observed follow-on actions. --- [Read the original source →](https://isc.sans.edu/diary/rss/33318?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*