Microsoft Security Research reported on the TerminalFix malware campaign that employs multistage intrusion techniques including reverse tunnels. A notable feature of this campaign is the use of PNG files with steganography to conceal payloads. Analysis of the PNG files shows they are valid images with no appended data or metadata containing the payload. Instead, the payload is hidden within the pixel data (IDAT chunk) using all bits, encoding Windows PE files inside the image pixels. The embedded PE files include LockScreenContentServer.exe, a legitimate Microsoft executable used for sideloading, and a malicious DLL split into two parts across separate PNG files. The use of all bits for payload storage results in visibly corrupted images, differing from typical least significant bit steganography that preserves image appearance.

The campaign enables threat actors to covertly deliver and execute malicious payloads by embedding them within PNG images, potentially evading traditional detection methods that do not inspect image pixel data. The use of a legitimate Microsoft executable for sideloading may facilitate execution of the malicious DLL payload. This technique complicates detection and analysis, increasing the risk of successful intrusion and persistence.

No official patch or fix is applicable as this is a malware campaign technique rather than a software vulnerability. Defenders should consider enhancing detection capabilities to analyze image files for steganographic content, especially PNG files with unusual pixel data patterns. Monitoring for known indicators of compromise (IOCs) related to the TerminalFix campaign and blocking or sandboxing suspicious image files can help mitigate risk. Vendor advisories or security research updates should be monitored for further guidance.