TerminalFix Hides Malware in PNGs and Leaves a Reverse Tunnel Into Corporate Networks

A ClickFix spinoff that Microsoft calls TerminalFix is hiding parts of its malware inside PNG images and ends by planting a reverse tunnel that gives attackers proxy access into the victim’s corporate network.

Microsoft Threat Intelligence described the campaign on Friday, saying it has targeted organizations across multiple industries through compromised websites. Victims see a fake Cloudflare CAPTCHA overlay that quietly copies a PowerShell command to the clipboard. Classic ClickFix lures tell people to paste that into the Windows Run dialog; TerminalFix steers them to Windows Terminal or PowerShell instead, which makes it easier to get a multi-line script executed.

From fake CAPTCHA to tunnel

The pasted command prints a reassuring “Starting Cloudflare verification…” message while downloading a ZIP archive. Inside are LockScreenContentServer.exe, a legitimate signed Windows binary, and a malicious dui70.dll posing as the Windows DirectUI Engine. Because Windows looks in the application’s own folder before System32, the signed program loads the planted DLL, so the attack runs inside a trusted process.

That DLL kicks off a second PowerShell script that downloads three PNG files from attacker domains. Pixel data in the first image carries an executable; the second and third each hold half of a DLL, which the script stitches back together. “After extraction, the source images are deleted to reduce forensic artifacts,” wrote Microsoft researchers Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan.

The malware then sets up two forms of persistence, Run registry keys and scheduled tasks that relaunch the signed binary every 60 minutes, and starts mapping the domain: trusts, domain admins, Active Directory users and computers, and pings to servers with telling names. “The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems,” the researchers wrote. A PowerShell loop also watches a text file and runs any commands written to it, The Register reported.

The last stage downloads a Python runtime and a custom client.py implant, launched through pythonw.exe with no visible window. It opens a reverse WebSocket tunnel to gitnow[.]dev on port 443, giving the attacker SOCKS-style TCP proxy access through the infected machine. Microsoft said it did not see the follow-on activity that access would allow in the chain it analyzed, but said organizations should treat affected devices as potential network pivot points and investigate for lateral movement and credential exposure.

Microsoft declined to tell The Register how many organizations were hit or who is behind the campaign.

What Microsoft recommends

The company’s mitigations start with restricting PowerShell for standard users through AppLocker, Application Control for Windows or Group Policy, and blocking or auditing the Win+R Run dialog where people don’t need it. It also wants employees trained to spot fake CAPTCHA pages that ask them to paste commands into Terminal or Run. The post also publishes indicators of compromise and hunting queries; the distinctive artifacts include LockScreenContentServer.exe loading an unsigned dui70.dll, hourly scheduled tasks pointing to that binary, and pythonw.exe connections to gitnow[.]dev.