Microsoft details 'TerminalFix' malware that hides in PNGs and dials home through firewalls

Microsoft's threat researchers published details on Monday of a ClickFix variant they call TerminalFix, a multi-stage intrusion that hides part of its payload inside a PNG image and then opens a reverse tunnel out of the victim's network, a connection the infected machine dials on its own, so the attacker can reach the host from the other side (Microsoft Threat Intelligence). The Register re-reported the findings the same day.

ClickFix is the family name for a social-engineering pattern in which a compromised website displays a fake CAPTCHA or "verification" overlay and instructs the visitor to copy and run a command. Older ClickFix variants usually walked the user to the Windows Run dialog, the small box where you can type a command and have the operating system execute it. TerminalFix steers the victim to Windows Terminal or PowerShell instead, on the theory, per Microsoft's write-up, that the alternate interface raises the success rate for the longer, multi-line scripts the rest of the chain needs.

The first command is the door. What the rest of the chain does is the story.

After the user runs the copied command, the attack moves through DLL sideloading, the practice of tricking a trusted program into loading a malicious file alongside its own, and steganographic payload extraction, the term for hiding code inside an ordinary-looking image. Microsoft's researchers saw the second-stage loader pull its instructions out of a PNG file already present on the infected host. The image opens. Nothing visible changes. The malware runs anyway.

The reverse tunnel is the half most wire summaries skip. A reverse tunnel is a connection where the infected machine dials out to an attacker-controlled server, and the attacker then uses that same channel to reach the machine from the other side. It is the opposite of the more familiar inbound attack, where a remote machine tries to connect to yours and the firewall decides whether to let it through. Once the outbound tunnel is up, the attacker has a path into the victim's network that does not need an open port on the firewall and does not need the user to click anything else. From a firewall's point of view, the connection is outbound, which most enterprise firewalls permit by default.

Earlier ClickFix variants typically delivered a single infostealer, malware that exists to harvest passwords, browser cookies, and session tokens and ship them back to the operator. TerminalFix deploys a multi-stage chain that includes Active Directory reconnaissance, mapping the victim's internal directory service to identify privileged accounts, before the operators decide what to do next. The end state is a persistent, network-level proxy: an always-available relay the attacker can route traffic through, qualitatively different from one-shot credential theft because the tunnel survives the initial intrusion and does not depend on the user running anything new.

Microsoft's write-up does not publish an exact victim count, sector breakdown, or attribution to a named threat group. The post documents the technique and the chain. The Register's piece restates the same findings in shorter form (The Register). Both should be read as a technique disclosure from one vendor research team, not as a measured campaign with a known footprint.

The update that matters for a smart reader is the pair, not either half alone. Image-based delivery has become a default for social-engineering payloads because image files pass the filters that screen executables. A reverse tunnel is becoming a default for the post-exploitation layer because it sidesteps the firewall posture most companies still run, which is to allow outbound traffic and block inbound. Combine the two, and a single image, opened or not, becomes a foothold that does not need another user action to be useful.

Microsoft's researchers recommend watching for outbound connections to unfamiliar endpoints, for image files dropped into unusual paths on user machines, and for the command patterns documented in the full write-up (Microsoft Threat Intelligence).