Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines An unknown miscreant is using "TerminalFix" to trick unsuspecting users into running PowerShell commands that infect their computers with a reverse tunnel granting attackers access to their networks. Some of the malware is even hidden inside PNG graphics the PC downloads. TerminalFix is the latest variant of the wildly popular …
This post has been deleted by its author
Oh this is why? A fake captcha on a website and a PowerShell command has something to do with HTML in email? Well, sounds convincing. I'm always worried when hearing opinions that the people making them either have no clue what they're talking about or haven't bothered to read up on what they're commenting on. Now that we know you wouldn't do either of those things, please go on and tell us what else we need to know.
.PNG file to transfer data, could have been .jpg etc as well. This is not "Image decoding" issue, the image is simply used to transfer data hidden in it. Whether it is in the compressed extif part, attached binary data at the end or whatever. That is not a Microsoft issue, you can do that nonsense with any OS, it does not even have to decode that actual picture like a web browser you use to check whether it IS a picture (and yes, it is a picture).
As much as I love bashing MS, especially since Windows 11, the "image" problem here has nothing to do with picture data decoding.
I see we have eleven people who either didn't read the article or are too stupid to understand what steganography means. You know the bugs that image decoding libraries have had where you can trigger buffer overflows, which incidentally are generally not written by OS people directly? It's not that. Try reading some more.
Could it be that's because I never surf without the browser add-on NoScript? By default, all JS is blocked. For trusted domains I have to allow it explicitly.
All of these attacks are based on JS. So if the unknown malicious domain is unable to play the script, no overlay appears or fake BSOD or fake update notice or ... you name it.
Employ script control!
Because you weren't on the site concerned? Blocking JS would remove exactly one part of this, automatically copying the PowerShell script to your clipboard. I don't know whether they did, but it would have been possible and in fact quite easy for them to use HTML alone to have a fake captcha page that displayed the text in a box and had the user copy and paste it. If you were going to tell me that seeing that text would have scared off users, please remember that, even with it copied to the clipboard, they were still instructed to manually launch a PS CLI and paste it in, and if they did it, they would have seen the text before it ran. If you think all the attacks are based on JS, then you are vulnerable from a false sense of security. It would be better to be aware what is possible and therefore on your guard.
I am online since > 30 years (in the beginning with Windows even) and I had NEVER a successful attack. Attempts, yes, I saw a lot.
ALL attempts involving 'clear click' (clickfix) or drive-by downloads rely on JS, at least those I encountered or analyzed just for curiosity.
Normally the domain bringing malicious JS is != the domain visited.
And as far as I'm concerned, the attack stops there.
There is no way I'm going to paste anything anywhere from a CAPTCHA page.
Not gonna happen.
That said, I applaud the attacker. Once again, malware writers show a lot more imagination and professionalism that Borkzilla coders.
How unfortunate that they do not do that kind of work for a legitimate cause.
While this is true, the necessary steps, as written in the article, already require a more advanced user...
Ask a normal user "open a terminal" oder "open powershell", and then you will see a clueless face (like mine when asking about the history of Belize) 'cause today that is not even remotely expected from a normal user. We are not in the pre Windows 3.1 / MacOS era here, where manuals were still several hundred pages of a book, and were actually written. (MS-DOS 5.0: > 700 pages, for example...)
I'm not sure it's that hard to describe to someone how to do it though. The instructions could easily give them the basic steps to open the window and some screenshots, and I think most users would be able to handle that step.
