{
  "id": 4712203,
  "title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
  "url": "https://urgent.news/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-4712203",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T18:26:03.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480"
  },
  "original_language": "en",
  "account": "An unknown attacker is using TerminalFix to trick users into running malicious PowerShell commands on their computers. TerminalFix is a variant of the popular ClickFix initial access method, which tricks users into running malicious commands by promoting them with fake fixes or CAPTCHA verifications. When victims interact with a spoofed Cloudflare CAPTCHA, they unknowingly copy a fake verification command to the clipboard, which then runs a hidden PowerShell script.\n\nThis script downloads a ZIP archive, extracts a malicious DLL, and launches a legitimate Windows executable that sideloads the malicious DLL. The attacker then delivers additional payloads hidden inside PNG images through steganography. The malware establishes persistence through registry keys and scheduled tasks, conducts reconnaissance on the victim's network, and drops a custom reverse tunnel implant that gives attackers persistent access to the compromised system. To avoid this campaign, Microsoft advises organizations to restrict PowerShell and Run dialog execution, and to train employees on identifying ClickFix tactics.",
  "summary": "Next-level ClickFix wave sets off multi-stage attack chain",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines",
        "url": "https://urgent.news/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on",
        "published": "2026-08-31T18:26:03.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}