TerminalFix Hides Malware in PNGs. It Still Needs You to Paste the Command.

1 SEP 2026 — Microsoft has documented a campaign it calls TerminalFix, which hides an executable and two halves of a DLL inside three PNG images and ends with a Python reverse tunnel to port 443. Steganography and signed-binary sideloading help it evade detection, and the attack's success hinges on its first step: getting a person to paste a command into their own terminal.

The chain, in order

The entry point is a fake Cloudflare verification page with a spoofed logo, which instructs the visitor to copy a string and run it. The string is a PowerShell command, and the page has already placed it on the clipboard.

Once run, a hidden script prints "Starting Cloudflare verification…" while downloading a ZIP archive into C:\\ProgramData, unpacking it and launching a file named 1.bat. That batch file starts LockScreenContentServer.exe, a legitimate signed Windows executable, which loads a malicious dui70.dll placed alongside it and presenting itself as the Windows DirectUI Engine.

The DLL runs a second PowerShell script that fetches three PNG images and extracts an executable from the first and the two halves of a DLL from the second and third. Persistence is established through an HKCU Run key and a scheduled task that re-launches the signed executable every 60 minutes.

Every clever part is post-compromise

Split a DLL across two images and static scanning of downloaded files has nothing to match on, since neither half parses as an executable. Load that DLL through a signed Microsoft binary and application allow-listing is satisfied, because the process appearing in the tree is one it permits.

Both belong to the same narrow discipline of staying unnoticed once resident. Arrival is handled somewhere else entirely.

It got there because someone was shown a page that looked like a bot check and did what it said. Microsoft's own framing puts TerminalFix in the ClickFix family precisely on that basis — the innovation over earlier versions is that it directs the victim to Windows Terminal or PowerShell rather than the Run dialog, because a terminal window makes the instruction look more plausible to a technical user.

What the reconnaissance tells you

Microsoft has not named a threat actor, a sector or a victim count. The reconnaissance behaviour says more than the absence of attribution suggests.

The implant enumerates domain trusts, domain administrators and Active Directory objects, and pings hosts by function: domain controllers, databases, backup, gateways and mail. An operator runs this sequence to decide whether a network is worth escalating in, which is a different objective from stealing one person's credentials. The specific check for backup servers is a classic ransomware precursor.

The reconnaissance runs in English, Spanish and German. An operator writes localised checks for the environments they expect to land in, which puts the intended targets in Europe and the Americas rather than in this region — for now, and with the caveat that a technique this cheap to run travels quickly.

Why steganography keeps coming back

Hiding code in images is a technique that gets rediscovered every few years, usually because it solves a recurring problem: getting past the perimeter.

An organisation that blocks executable downloads, inspects archives and strips scripts at the proxy will still allow a PNG through, because blocking images breaks every website it wants staff to use. PNG earns its place in the chain by being unfilterable rather than by being clever.

Splitting the DLL across two images adds a second property: neither file is a valid executable, so a scanner that extracts and inspects embedded content finds nothing that parses. Reassembly happens in memory on the victim's machine, where the file-inspection layer has already been passed.

Where the detection opportunity actually is

Do not look to the network layer for detection. A reverse WebSocket tunnel to a host on port 443 is indistinguishable from ordinary HTTPS at the perimeter. The SOCKS-style proxy it provides makes subsequent traffic look as though it originated inside.

The file layer will not help either, for the reasons above. What is left is process ancestry, and there the behaviour is loud. A signed Windows executable named LockScreenContentServer.exe running from C:\\ProgramData rather than System32 is wrong on its own. That same process spawning PowerShell, and later pythonw.exe, is a sequence with no legitimate explanation.

Three detections are worth writing, and each stands on its own without any knowledge of this campaign: a scheduled task re-executing a binary from a user-writable directory on a fixed short interval, pythonw.exe running with no parent development tooling, and PowerShell invoked by a process whose normal role does not include scripting.

The control that prevents it

One habit defeats every clipboard-to-terminal attack: never run a command you did not write to solve a problem you did not have. A genuine bot check is completed in the browser and never requires a terminal.

For organisations, the enforceable version is constrained language modes and execution policy for PowerShell on standard user workstations, plus blocking script execution from user-writable paths. Neither is exotic and both are commonly left unconfigured because they generate helpdesk friction.

The awareness message is also unusually easy to write, because it has a single sentence in it. We reported on extensions that were acquired and then poisoned through an update, where users had no defensible action available to them. Here the entire attack depends on a person performing a deliberate and unusual step, and that is the rare situation where telling people what not to do actually works.