Microsoft recently documented TerminalFix, an evolution of the ClickFix social-engineering technique that replaces a familiar Windows Run prompt with instructions to use Windows Terminal or PowerShell. The campaign begins on a compromised website displaying a convincing fake Cloudflare Turnstile verification. When the visitor interacts with the prompt, the page silently places a malicious PowerShell command on the clipboard and tells the user to paste it into a terminal.
No vulnerability is required. The victim is persuaded to initiate the attack personally, under the impression that the command is completing a legitimate CAPTCHA verification.
Once executed, however, the campaign becomes highly dependent on files. The PowerShell command downloads a ZIP archive, extracts a signed Windows executable beside a malicious DLL, and launches a DLL-sideloading sequence. The malicious DLL then retrieves additional payloads concealed inside PNG images, establishes persistence, performs extensive Active Directory reconnaissance and deploys a Python-based reverse tunnel.
This distinction is important when evaluating the role of FileDNA Content Analysis, Disarm and Reconstruction (CADR). FileDNA cannot prevent every part of TerminalFix, especially its initial browser-based deception. But the campaign exposes several file-content control points where FileDNA can identify, block or neutralize the material needed to continue the intrusion.
The TerminalFix attack chain
The observed sequence can be summarized as follows:
The fake CAPTCHA copies a disguised PowerShell command to the clipboard. After the user pastes it into Windows Terminal or PowerShell, the command downloads a ZIP archive, extracts its contents under C:\ProgramData, and launches a batch file.
The archive contains a legitimate, signed Windows component named LockScreenContentServer.exe and an attacker-controlled dui70.dll. The legitimate executable has a dependency on that DLL. Because Windows searches the local application directory when resolving the dependency, the executable loads the malicious copy placed alongside it rather than the legitimate system DLL.
The rogue DLL then launches another PowerShell stage. This stage downloads three PNG images from attacker-controlled infrastructure. An executable is encoded into the pixel values of the first image, while two pieces of another DLL are concealed in the other two images. The script reads the RGBA channels, reconstructs the hidden bytes and combines the DLL fragments on disk.
After delivery, the malware creates persistence through a Registry Run key and a scheduled task, conducts system and Active Directory discovery, and deploys a Python implant that establishes an encrypted WebSocket connection to its command-and-control server. The implant gives the attacker SOCKS-style TCP proxy access to other systems visible from the compromised endpoint, effectively turning that machine into an internal network pivot point.
The downloaded ZIP archive
The ZIP archive represents the strongest and earliest FileDNA interception opportunity in the observed chain.
A conventional security product may evaluate the signed Microsoft executable as trustworthy or search for a known hash associated with the malicious DLL. FileDNA can instead examine the complete structure and functional relationship of the files within the archive. The important question is not simply whether one component carries a valid signature. It is why a signed Windows system component is being delivered inside an internet-downloaded archive beside an unsigned local replacement for one of its imported libraries.
FileDNA can unpack the archive and evaluate the collection as a single delivery package, including:
- The batch file and the commands it is designed to execute.
- The presence of executable content inside a downloaded archive.
- The legitimate signed executable and its expected DLL dependencies.
- The unsigned
dui70.dllpositioned for local sideloading. - Inconsistent DLL identity, metadata or signing information.
- Obfuscated code or executable resources embedded inside the malicious DLL.
- The combined behavior produced by the script, executable and DLL rather than the reputation of each file in isolation.
This allows a policy decision to be based on structural evidence. For example, an organization could quarantine archives that contain script-driven executable chains, block signed Windows components delivered outside their normal operating location, or reject packages that combine batch scripts, executables and unsigned libraries in a DLL-sideloading arrangement.
For this type of package, blocking or quarantining is generally more appropriate than attempting to reconstruct it. The archive is not an ordinary business document containing one removable unsafe element; its apparent purpose is to deliver and execute code.
FileDNA Desktop could apply this control when the archive lands on an endpoint. FileDNA Server or FileDNA Connect could enforce the same decision earlier through a secure web gateway, download proxy, EDR, MDR or other content-inspection workflow. FileDNA telemetry could then send the structural findings (including the archive hierarchy, script behavior, DLL relationship and policy decision) to the organization’s SIEM or SOC platform.
Payloads hidden inside PNG images
The image-delivery stage is another direct connection to FileDNA’s true-content analysis model. The files are valid PNG images, but the attackers use their decoded RGBA pixel values as a container for executable data. The visible format therefore does not describe the complete security meaning of the content.
This is precisely why file extensions and superficial format validation are insufficient. A security control may confirm that a file begins with a valid PNG signature, parses correctly and renders as an image while missing the machine-readable payload encoded in its pixels.
Reliable protection against this technique requires more than ordinary image parsing. FileDNA’s image-analysis pipeline would need to examine decoded pixel channels for indicators such as unexplained high-entropy regions, encoded length values, executable-like byte sequences or other statistical and structural evidence of concealed binary content. In this campaign, cross-file context is also valuable because the attackers divide a DLL between two different images and reconstruct it only after both files arrive.
There is an important technical qualification: merely opening and losslessly re-encoding a PNG may not neutralize pixel-based steganography. If reconstruction preserves the original RGBA values, it can also preserve the hidden payload. Effective disarmament therefore requires a controlled image-normalization process that deliberately disrupts the concealed machine data while maintaining acceptable visual quality. Alternatively, policy can block or quarantine images whose pixel-channel characteristics cannot be safely explained.
A meaningful validation test for FileDNA is not simply whether the reconstructed output remains a valid and viewable PNG. The decisive test is whether the attacker’s extraction routine can still recover the executable bytes from the reconstructed image.
Where FileDNA has limited or no direct coverage
Accurate positioning also requires identifying the stages that fall outside the normal CADR boundary.
Fake CAPTCHA and clipboard manipulation
The initial Cloudflare imitation is browser-based social engineering. At this point, no downloaded file is necessarily available to FileDNA. A standard FileDNA deployment therefore cannot stop the user from believing the fake instructions or prevent the web page from copying text to the clipboard.
Browser security, URL reputation, managed-browser policies, web filtering and user education are the appropriate primary controls for this stage.
Pasted PowerShell execution
The malicious command is executed directly from the clipboard. FileDNA could analyze the PowerShell content if an endpoint, browser or PowerShell integration submits it for inspection, but ordinary file scanning will not automatically see a command that exists only in clipboard and process memory.
Application control, restricted PowerShell access, Constrained Language Mode, script-block logging and controls that warn about multiline terminal pastes provide more direct protection here.
Persistence, reconnaissance and reverse tunneling
Registry changes, scheduled tasks, Active Directory enumeration, internal network probing and encrypted command-and-control traffic are endpoint, identity and network behaviors. Once the attack reaches these stages, EDR/XDR, application control, SIEM analytics, identity monitoring and network detection and response become the principal controls.
FileDNA may contribute forensic evidence about the files that initiated the activity, but it should not be presented as a replacement for these behavioral security layers.
FileDNA as part of a layered response
TerminalFix demonstrates why content security and behavioral detection are complementary.
Browser and awareness controls attempt to keep the user from following the fake CAPTCHA instructions. PowerShell and application-control policies attempt to prevent the copied command from running. FileDNA examines and controls the files the command retrieves. EDR and XDR monitor execution, persistence and reconnaissance. Network security detects or blocks the reverse tunnel and subsequent lateral access.
It does not need to wait for the malicious DLL to establish persistence or for the reverse tunnel to begin communicating. At the ZIP stage, the suspicious relationship among the files already provides actionable evidence. At the PNG stage, true-content analysis can expose the difference between what the object claims to be and the binary information it actually carries.
Conclusion
TerminalFix begins as a social-engineering attack that no file-analysis engine can prevent on its own. Once the victim executes the copied PowerShell command, however, the intrusion relies on a sequence of downloaded and reconstructed content: an archive, a batch file, a signed executable, a malicious sideloaded DLL, obfuscated resources and executable data concealed across PNG images.
These dependencies create meaningful opportunities for FileDNA CADR to break the chain. Positioned at the endpoint, download gateway or an integrated security platform, FileDNA can inspect the initial archive, expose the DLL-sideloading relationship, analyze the scripts and embedded resources, and examine apparently benign images for concealed executable material. Blocking the malicious archive provides the clearest early prevention point. Detecting or safely transforming the pixel-encoded payloads offers a second, more technically demanding layer of protection.
The broader lesson is not that FileDNA replaces browser, endpoint or network security. It is that TerminalFix depends on content moving successfully between those layers. FileDNA supplies the content-security control needed to examine that material before it becomes execution, and before a fake CAPTCHA is transformed into a persistent internal network foothold.
References
- Microsoft Security Research, “TerminalFix campaign deploys a reverse tunnel through multistage intrusion,” August 28, 2026: microsoft.com/security/blog
- The Hacker News, “TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor,” August 30, 2026: thehackernews.com