Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines
- ID
- 19975
- Status
- summarized
- Published
- 01 Sep 2026, 2:26 AM
- Fetched
- 01 Sep 2026, 4:50 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/31/attack-hides-malware-in-pngs-and-drops-custom-reverse-tunnel-on-victims-machines/5293480
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 5.5
- Created
- 01 Sep 2026, 4:52 AM
- Tags
- Audience
- developersai_agent_users
What happened
A new ClickFix variant called 'TerminalFix' tricks users into pasting malicious PowerShell commands via fake Cloudflare CAPTCHA overlays, then executes a multi-stage chain using DLL sideloading (via signed Windows executable LockScreenContentServer.exe), steganographic payload extraction from PNG files, and Active Directory reconnaissance, ultimately deploying a custom reverse tunnel for persistent network-level access. Microsoft declined to disclose victim counts or attribution.
Why it matters
If you or your team use Windows Terminal/PowerShell and encounter CAPTCHA-style verification prompts on unfamiliar sites, treat any clipboard-paste instruction as suspicious — this attack specifically targets terminal users by spoofing Cloudflare verification and hiding payloads in image files, making standard endpoint detection less effective.
Discussion angle
How ClickFix-style attacks are evolving to target developer-adjacent workflows (terminal paste) and whether your team's endpoint policies would catch DLL sideloading via signed executables or steganographic payloads in downloaded images.