As cited
Copy frozen at (site build).
threat intel
TerminalFix: PNG Steganography
A threat actor campaign called TerminalFix embedded malicious Windows executables and DLLs inside PNG files using steganography, with the payload hidden in the pixel data rather than appended to the file. Analysis of the PNG files revealed a legitimate Microsoft executable (LockScreenContentServer.exe) used for sideloading and malicious DLL payloads split across two additional images, all encoded within the RGBA pixel values using all available bits rather than least significant bits alone.
Why it matters: Organizations need to monitor for PNG files with anomalous pixel data and sideloading techniques, as steganography in image files can bypass traditional file-based detection and deliver remote access tools or other payloads.
- Source published
- First seen by Cybersecurity Tracker