Malicious TerminalFix campaign hides payloads in PNGs and creates custom reverse tunnel
A new TerminalFix attack lures users into running PowerShell commands that install a multi-stage malware chain, including steganographically hidden payloads and a persistent reverse-tunnel proxy.
Attackers deploy a counterfeit Cloudflare CAPTCHA that tricks users into copying a verification command and pasting it into Windows Terminal or PowerShell. The hidden PowerShell script fetches a ZIP archive, extracts it to C:\ProgramData, and runs a legitimate signed executable, LockScreenContentServer.exe, which serves as a host for a malicious DLL named dui70.dll. A second PowerShell stage then downloads three PNG files, extracts an executable and two DLL fragments, and reassembles them on disk, deleting the source images to limit forensic traces.
The payload sets up redundant persistence through HKCU\…\Run keys and hourly scheduled tasks, gathers system and Active Directory data across multiple language settings, and creates a file-watch loop for remote command execution. Finally, a custom Python reverse-tunnel runs via pythonw.exe, opening a WebSocket tunnel to gitnow.dev:443, providing the attacker with a SOCKS-style proxy into the victim’s network. Microsoft advises limiting PowerShell and Run dialog usage and training users to recognize fake CAPTCHA-driven ClickFix tactics.
Why it matters
The technique shows how attackers can hide malware in common image files and gain persistent network access, raising the threat to corporate IT environments.
In this story
