{
  "id": 4708570,
  "title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
  "url": "https://urgent.news/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T18:26:03.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480"
  },
  "original_language": "en",
  "account": "A malicious actor is utilizing TerminalFix to deceive users into executing PowerShell commands, resulting in their computers being infected with a reverse tunnel that grants attackers remote access to the victim's network. This variant of ClickFix social engineering technique is designed to trick users into running malicious commands by presenting them with a false fix or CAPTCHA verification. Instead of directing users to the Windows Run dialog, TerminalFix sends them to Windows Terminal or PowerShell, increasing the likelihood of them inadvertently executing multi-line scripts on their own systems. This campaign goes beyond a single infostealer and initiates a multi-stage attack chain that includes DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance. The final outcome is a custom reverse tunnel deployed on the infected machine, providing attackers with persistent, network-level proxy access through the compromised device. The attack begins when the victim engages with a deceptive overlay that mimics a Cloudflare CAPTCHA, prompting a fake verification command to be copied to the clipboard. The command runs a hidden PowerShell script that prints a fake \"Starting Cloudflare verification…\" message and downloads a ZIP archive from a server controlled by the attacker. The archive is extracted to C:\\ProgramData, which then launches a batch file (1.bat) that silently executes LockScreenContentServer.exe. This legitimate, signed Windows executable serves as the host for the malicious DLL, dui70.dll, which runs a second-stage PowerShell script once sideloaded. This secondary PowerShell script downloads additional payloads hidden within PNG images, a technique called steganography. The attacker splits the payload into multiple PNG files to further obfuscate it and avoid detection. After extraction, the source images are deleted to minimize forensic artifacts. The malware then establishes redundancy through both HKCU\\…\\Run registry keys and scheduled tasks that repeatedly execute LockScreenContentServer.exe every 60 minutes to ensure its survival through reboots. It also conducts reconnaissance on the compromised machine, gathering system information across multiple languages, including English, Spanish, and German. The malware performs domain trust discovery, admin enumeration, and Active Directory user and computer searches while pinging named servers to identify accessible target systems. Finally, the malware drops a persistent PowerShell file-watch loop that monitors a text file for new commands, executes them via Invoke-Expression, and writes the results to an output file, allowing the attacker to deploy additional PowerShell commands. Microsoft advises organizations to restrict PowerShell and Run dialog execution, block or audit the Windows Run dialog if it's not necessary, and educate employees to identify ClickFix tactics, such as fake CAPTCHA verification pages that instruct them to paste commands into Terminal or the Run dialog.",
  "summary": "Next-level ClickFix wave sets off multi-stage attack chain",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
        "url": "https://urgent.news/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-4712203",
        "published": "2026-08-31T18:26:03.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}