Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines

An unknown miscreant is using "TerminalFix" to trick unsuspecting users into running PowerShell commands that infect their computers with a reverse tunnel granting attackers access to their networks.

Some of the malware is even hidden inside PNG graphics the PC downloads.

TerminalFix is the latest variant of the wildly popular ClickFix initial access method for attackers.

This type of social engineering technique tricks users into running malicious commands by promoting them with a phony fix or CAPTCHA verification.

While traditional ClickFix attacks point victims to the Windows Run dialog, TerminalFix directs users to Windows Terminal or PowerShell, which increases the likelihood that they will unknowingly run multi-line scripts on their own computers, Redmond says.

Plus, instead of delivering just one infostealer, this campaign kicks off a multi-stage attack chain that combines DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance.

It ultimately deploys a custom reverse tunnel on the infected machine that gives the attacker persistent, network-level proxy access through the compromised device.

Microsoft declined to answer The Register’s questions, including how many organizations were targeted and victimized in this TerminalFix campaign, and which attacker or criminal crew is responsible for these attacks.

The attack chain begins when the victim interacts with a phony overlay that spoofs the Cloudflare CAPTCHA “verify you are human” checkbox and includes a Cloudflare logo, causing a fake verification command to be copied to the clipboard before the victim pastes it into Windows Terminal or PowerShell.

This command runs a hidden PowerShell script that prints a fake “Starting Cloudflare verification…” message and downloads a ZIP archive from an attacker-controlled server.

It extracts the archive under C:\ProgramData and launches a batch file (1.bat) that silently executes LockScreenContentServer.exe.

LockScreenContentServer.exe is a legitimate, signed Windows executable - and it acts as the DLL sideloading host for a second file: dui70.dll.

This purports to be a “Windows DirectUI Engine,” but is actually the malicious payload, which executes a second-stage PowerShell script once it’s sideloaded.

The second PowerShell script downloads additional payloads hidden inside PNG images - this is called steganography, and it makes file- and content-type inspection more difficult, and thus easier to hide malicious payloads.