# New Cyberattack Hides Malware in PNG Files TerminalFix malware tricks users into executing malicious PowerShell commands. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-31 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0ede8b23-9c26-452c-947d-36616548d582 ## TerminalFix: Next-Gen Social Engineering TerminalFix deceives users through fake CAPTCHA verification pages, forcing them to execute PowerShell commands. Unlike traditional ClickFix attacks, this method directly redirects to Windows Terminal or PowerShell. Microsoft states this approach increases the likelihood of multi-line scripts running unnoticed. Attackers employ a multi-stage attack chain to establish persistent access to victims' systems. ## Malicious Code Hidden in PNGs Attackers conceal malicious payloads within PNG image files using steganography techniques. This method bypasses file inspection processes. The PowerShell script downloads three separate PNG files, extracting an executable from one and two halves of a DLL from the others. After reassembling components on disk, source images are deleted. Microsoft researchers note this technique reduces forensic evidence. ## Bypassing Defenses with DLL Sideloading The attack chain begins through LockScreenContentServer.exe, a legitimate signed Windows executable that serves as a sideloading host for malicious dui70.dll. Disguised as 'Windows DirectUI Engine', the DLL actually triggers a second-stage PowerShell script. This technique makes it harder for security software to detect malicious activities. ## 60-Minute Persistence Mechanism The malware maintains persistence through registry Run keys and scheduled tasks that relaunch LockScreenContentServer.exe every 60 minutes. This ensures access survives system reboots. The software also collects system information across multiple language configurations including English, Spanish, and German. ## Active Directory Reconnaissance The malware performs domain trust discovery, domain admin enumeration, and Active Directory user/computer searches while pinging targeted named servers. Microsoft threat hunters note these names correspond to critical infrastructure roles like domain controllers, databases, and backup systems. ## File Watch Loop for Command Control Attackers establish a persistent PowerShell loop that monitors a text file for new commands. The loop executes commands via Invoke-Expression and writes results to an output file. This mechanism allows remote execution of additional PowerShell commands. ## Python-Based Reverse-Tunnel Threat The final stage deploys a custom Python-based reverse-tunnel implant. Launched invisibly via pythonw.exe, the tunnel establishes a WebSocket connection to gitnow[.]dev:443. Combined with earlier reconnaissance data, this implant provides SOCKS-style TCP proxy access to attackers. ## Protection Measures and Awareness Microsoft recommends organizations restrict PowerShell and Run dialog executions. The Windows Run dialog (Win+R) should be blocked or audited if not needed for daily operations. Employee training is critical to recognize ClickFix tactics like fake CAPTCHA pages prompting command pasting into Terminal. ## Sources covering this story - https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._