TerminalFix Campaign Hides Malware in PNGs, Deploys Custom Reverse Tunnel
A new attack campaign dubbed 'TerminalFix' uses social engineering and steganography to deliver a custom reverse tunnel, granting attackers network-level access.
A sophisticated new attack campaign, identified as "TerminalFix," is leveraging social engineering tactics to trick victims into executing malicious PowerShell commands that ultimately establish a custom reverse tunnel on their systems. This campaign represents an evolution of the "ClickFix" initial access method, now directing users to Windows Terminal or PowerShell, increasing the likelihood of unintentional script execution.
The attack chain commences with a deceptive overlay mimicking a Cloudflare CAPTCHA. When users interact with this fake verification, a malicious command is copied to their clipboard. Upon pasting this command into Windows Terminal or PowerShell, a hidden PowerShell script initiates the download of a ZIP archive from an attacker-controlled server. This archive is extracted, and a batch file silently executes a legitimate Windows executable, LockScreenContentServer.exe, which serves as a host for a malicious DLL.
Once the legitimate executable loads the malicious dui70.dll, a second-stage PowerShell script is executed. This script employs steganography, a technique that hides data within other files, to download additional payloads concealed within PNG images. The attackers split the malicious payload across multiple PNG files, downloading them, extracting the components, and reassembling the executable on disk. To further evade detection and reduce forensic artifacts, the original PNG images are deleted after payload extraction.
TerminalFix ensures persistence through both registry run keys and scheduled tasks, which re-execute the LockScreenContentServer.exe every hour. Following persistence, the malware conducts extensive reconnaissance on the compromised machine. This includes gathering system information across various language configurations and performing detailed enumeration of domain trusts, domain administrators, and Active Directory users and computers, potentially identifying critical infrastructure for follow-on attacks.
The campaign then establishes a command-and-control mechanism through a persistent PowerShell file-watch loop. This loop monitors a text file for new commands, executes them using Invoke-Expression, and logs the results. This allows attackers to remotely issue commands and receive output, effectively controlling the compromised system.
Finally, the attackers deploy a custom, Python-based reverse-tunnel implant. This implant operates discreetly, launching without a visible window via pythonw.exe, and establishes a reverse WebSocket tunnel to a remote server. This implant, combined with the preceding reconnaissance, grants the attackers SOCKS-style TCP proxy access, enabling them to traverse the victim's network at a deep level.
Microsoft researchers highlight that this campaign combines multiple advanced techniques, including DLL sideloading, steganographic payload extraction, and thorough Active Directory reconnaissance, culminating in a powerful network-level access tool for adversaries. While Microsoft has not disclosed the number of targeted organizations or the specific threat actor responsible, the campaign's sophistication underscores the evolving threat landscape.