Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines

A new wave of attacks, dubbed TerminalFix, is leveraging a sophisticated social engineering technique to trick users into running malicious PowerShell commands. The campaign utilizes fake CAPTCHA verification pages to deliver a multi-stage attack chain involving DLL sideloading, steganography (hiding malware in PNG images), and reconnaissance, ultimately deploying a custom reverse tunnel for persistent network access. Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan observed this campaign and detailed its mechanics.

The attack begins when a victim interacts with a phony overlay that spoofs the Cloudflare CAPTCHA “verify you are human” checkbox and includes a Cloudflare logo, causing a fake verification command to be copied to the clipboard before the victim pastes it into Windows Terminal or PowerShell. This command runs a hidden PowerShell script that prints a fake “Starting Cloudflare verification…” message and downloads a ZIP archive from an attacker-controlled server. It extracts the archive under C:\ProgramData and launches a batch file (1.bat) that silently executes LockScreenContentServer.exe.

LockScreenContentServer.exe is a legitimate, signed Windows executable - and it acts as the DLL sideloading host for a second file: dui70.dll. This purports to be a “Windows DirectUI Engine,” but is actually the malicious payload, which executes a second-stage PowerShell script once it’s sideloaded. The second PowerShell script downloads additional payloads hidden inside PNG images - this is called steganography, and it makes file- and content-type inspection more difficult, and thus easier to hide malicious payloads. In an attempt to further obfuscate the payload and avoid being detected, the attacker split the payload into multiple PNGs.

The PowerShell script downloads the three images, extracts an executable from the first image and two halves of the DLL from the second and third images, and then reassembles the components on disk. After extraction, the source images are deleted to reduce forensic artifacts.

The malware establishes redundant persistence through both HKCU\…\Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes to ensure it survives reboots.

It then does reconnaissance on the compromised machine, scooping up system information across multiple language configurations including English, Spanish, and German. It also performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches, while pinging targeted, named servers. “The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems,” according to the threat hunters. “This probing could help an attacker identify accessible target systems for follow-on activity.”

Next, the malware drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file. This allows the attacker to execute additional PowerShell commands by writing them to the text file.

Finally, the attacker deploys a custom, Python-based reverse-tunnel implant. The tunnel launches with no visible window via pythonw.exe, and it sets up a reverse WebSocket tunnel to gitnow[.]dev:443. This implant, combined with earlier reconnaissance data, gives the attacker SOCKS-style TCP proxy access through the victim’s network.

Microsoft recommends organizations take several steps to avoid becoming a victim of this campaign. These include restricting PowerShell and Run dialog execution, and either blocking or auditing the Windows Run dialog (Win+R) if it’s not needed for daily work. Also, train employees on how to look for ClickFix tactics, like fake CAPTCHA verification pages that tell them to paste commands into Terminal or the Run dialog. ®