Attackers Hide Malware in Images, Deploy Custom Tunnels to Breach Networks

An unknown attacker is using a new social engineering tactic called "TerminalFix" to trick victims into running PowerShell commands that install a custom reverse tunnel, granting persistent access to corporate networks, according to a security report from Microsoft published August 31. The campaign represents an evolution of the ClickFix attack method, now directing users to Windows Terminal or PowerShell instead of the Run dialog, which makes it easier to execute multi-line scripts without detection. Unlike earlier attacks that simply deployed infostealers, this multi-stage operation combines DLL sideloading, steganographic payload extraction hidden inside PNG image files, and Active Directory reconnaissance before establishing network-level proxy access through compromised machines.

The attack begins when victims interact with a fake Cloudflare CAPTCHA overlay that copies a malicious command to their clipboard, which they then paste into Windows Terminal or PowerShell. That command runs a hidden script displaying a phony "Starting Cloudflare verification…" message while downloading a ZIP archive from an attacker-controlled server, extracting it to C:\ProgramData, and launching a batch file that silently executes LockScreenContentServer.exe. This legitimate, signed Windows executable acts as the host for DLL sideloading of dui70.dll, a malicious file masquerading as a "Windows DirectUI Engine" that executes a second-stage PowerShell script. The second script downloads three PNG images containing hidden payloads split across multiple files: one executable extracted from the first image and two halves of a DLL from the second and third images, which are then reassembled on disk. After extraction, the source images are deleted to reduce forensic artifacts, the report notes. The malware establishes redundant persistence through both registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes to survive reboots.

The reconnaissance phase collects system information across multiple language configurations including English, Spanish, and German, while performing domain trust discovery, domain admin enumeration, and Active Directory user and computer searches. "The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems," Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan wrote, adding that this probing could help an attacker identify accessible target systems for follow-on activity. The malware also drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file, allowing attackers to run additional PowerShell commands simply by writing them to the text file. Finally, the attacker deploys a custom, Python-based reverse-tunnel implant that launches with no visible window via pythonw.exe and sets up a reverse WebSocket tunnel to gitnow[.]dev:443, giving the attacker SOCKS-style TCP proxy access through the victim's network.

The report explains that TerminalFix increases the likelihood victims will unknowingly run multi-line scripts compared to traditional ClickFix attacks because Windows Terminal and PowerShell appear more technical and trustworthy than the Run dialog. The use of steganography to hide payloads inside PNG images makes file- and content-type inspection more difficult, allowing malicious executables to pass through security filters that would normally flag suspicious downloads. Splitting the payload across multiple images further obscures the attack, as each individual PNG appears innocuous on its own. The combination of legitimate signed executables for DLL sideloading, steganographic concealment, and deletion of source files creates multiple layers of obfuscation designed to evade endpoint detection and complicate forensic investigation.

Microsoft recommends that organizations restrict PowerShell and Run dialog execution, and either block or audit the Windows Run dialog if it isn't needed for daily work. Employee training on recognizing ClickFix tactics is essential, particularly fake CAPTCHA verification pages that instruct users to paste commands into Terminal or the Run dialog. Microsoft declined to answer questions about how many organizations were targeted and victimized in this TerminalFix campaign, or which attacker or criminal crew is responsible for these attacks. Enterprises that rely on user vigilance as a primary defense layer may need to reconsider whether technical controls can substitute for human judgment when even sophisticated employees struggle to distinguish legitimate security prompts from social engineering. The shift toward multi-stage, infrastructure-focused attacks suggests defenders should prioritize network segmentation and assume initial compromise rather than betting exclusively on perimeter prevention.