TerminalFix Destroys PNG Images to Bury Malware Deeper

The TerminalFix campaign, active since August 28, 2026, employs a steganography variant that abandons visual plausible deniability to gain a decisive technical edge. Operators conceal Windows executables (PE and DLL files) inside structurally valid PNG files, but instead of limiting themselves to the least significant bits — the classic LSB approach that preserves the image — they encode the binary payload across all bits of the RGBA pixels. The result is a PNG that slips past automated checks but, once rendered, displays an irrecoverably corrupted image.

The choice is functional: steganography detection tools focus on metadata anomalies or subtle alterations in the least significant bits. A PNG that uses the entire pixel space as pure binary memory flies under the radar of these checks, even though it is visually "noisy" enough not to raise suspicion in an automated download context.

How the Payload Hides in Pixels: The SANS ISC Analysis

The technical analysis conducted by Didier Stevens for the SANS Internet Storm Center starts from the PNG file with SHA-256 hash f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe. Using pngdump.py, a proprietary tool from the collection, confirms the formally correct structure: decompressible IDAT, 111 scanlines, 112 columns, standard SUB filters, no anomalous metadata. The dimensions — 112 columns by 111 rows with 4-byte RGBA pixels — yield 448 bytes per scanline.

Enabling raw bitmap data extraction (the -R option), the analyst finds the embedded payload length in the first 8 bytes: 49,720 bytes. Immediately after appears the DOS stub "This program cannot be run in DOS mode," the unmistakable signature of a Windows Portable Executable. The carved PE corresponds to LockScreenContentServer.exe, a legitimate Microsoft operating system executable weaponized for sideloading.

Two additional PNG files, analyzed with the same method, contain the malicious DLL fragmented into two parts. These also use the same full-bit technique. Payload reconstruction passes through standard PNG filters — SUB and others defined by the specification — to obtain the raw bitmap, then sequential reading of the bytes as a pure binary stream.

"The threat actors decided to use all of the available bits. The original medium is lost, and the PNG looks like this when rendered" — Didier Stevens, SANS ISC

From Fake CAPTCHA to Reverse Tunnel: The TerminalFix Chain

Microsoft Threat Intelligence has tracked the campaign as an evolution of ClickFix, with a critical variant: instead of directing the victim to the Run dialog, TerminalFix pushes the user toward Windows Terminal and PowerShell. The initial vector is a fake CAPTCHA that instructs the user to copy and paste PowerShell commands, exploiting ingrained verification habits.

The sideloaded DLL — dui70.dll — executes PowerShell that downloads the PNG files from attacker-controlled domains and reconstructs the fragmented payload. Final execution occurs via pythonw.exe, with no visible window, using a Python client that establishes a WebSocket connection to gitnow[.]dev on port 443. Through this channel, operators gain "full SOCKS-style TCP proxy access," according to Microsoft's description.

Persistence is ensured by a scheduled task with a 60-minute interval. The campaign has hit "multiple industries," but the dossier does not specify victim counts or precise sectors beyond this indication.

Why Abandoning LSB Changes the Defensive Game

Traditional LSB steganography pursues a dual objective: hide the payload and keep the original image sufficiently intact to avoid suspicion. TerminalFix inverts this logic. The priority is no longer visual plausible deniability — the average user does not open every browser-downloaded file in a viewer — but evasion of automated checks.

Steganography detection tools expect anomalies in the least significant bits or in non-standard metadata. A file that distributes the payload across all pixel bits, correctly applying the PNG specification, presents none of these anomalies. The SUB filter, part of the standard encoding, is handled regularly during extraction. It is unclear from the dossier whether the filter is actively exploited or simply processed as the specification dictates.

For forensic analysts, this evolution demands a methodological shift: inspecting metadata and appendices after IEND is no longer enough. It is necessary to extract raw pixels, decompressed and filtered, and analyze them as a binary stream. The conventional toolset, optimized for LSB and appended data, must integrate carving capabilities on decompressed bitmaps.

What to Do Now

• Inspect suspicious PNG files at the raw decompressed pixel level, not just metadata and after-IEND structures: analysis tools must apply standard PNG filters and read the result as a binary stream
• Monitor outbound WebSocket connections to uncategorized domains, particularly on port 443 with SOCKS-like traffic patterns: TerminalFix's reverse tunnel uses this channel to bypass perimeter firewalls
• Detect pythonw.exe execution with active network connections and no visible user interface: the use of Python as a runtime for the tunneling client is a specific behavioral indicator of the campaign
• Check for scheduled task creation with regular 60-minute intervals pointing to executables in non-standard paths or to PowerShell scripts that download images: this persistence mechanism is documented in the attack chain

Questions and Answers

Why did the attackers accept losing the original PNG image?

The dossier offers no explicit rationale, but the technical reading suggests an optimization choice for automated evasion. Security checks focus on LSB techniques and metadata anomalies; a payload distributed across all bits, with a formally correct PNG structure, does not trigger these alarms. The corrupted image is irrelevant if the download occurs without human viewing.

Are standard PNG filters part of the attack or normal decoding?

The filters — including SUB — are documented as part of the standard PNG encoding applied during extraction. The dossier does not clarify whether they are actively exploited to obfuscate the payload or simply processed to obtain the raw bitmap. Cautious wording is necessary on this point.

Is TerminalFix linked to known groups?

The dossier reports no attributions to specific actors nor infrastructure overlaps with previous campaigns. The WebSocket reverse tunnel technique and sideloading of legitimate Microsoft binaries are not exclusive to a single activity cluster.

Sources

• https://isc.sans.edu/diary/rss/33318
• https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• https://www.virustotal.com/gui/file/f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe