SANS unpacks TerminalFix PNG steganography and the Macfinger ClickFix macOS infostealer campaign

Across three posts (Sep 21–25, 2026), SANS Internet Storm Center details the TerminalFix Windows campaign hiding a DLL inside PNG pixel data for side-loading, and the Macfinger ClickFix campaign delivering a macOS credential stealer — assessed as not an AMOS…

SANS Internet Storm Center published three related malware analyses between 2026-09-21 and 2026-09-25. On Sep 21, handler Didier Stevens dissected PNG IOCs from a Microsoft Security Research report on the TerminalFix campaign, a multistage intrusion deploying a reverse tunnel. The PNGs are structurally valid (IHDR, IDAT, IEND chunks; RGBA; 111x112 pixels), but every pixel bit encodes payload data rather than a visible image — not LSB steganography. The raw bitmap begins with a little-endian PE length of 49,720 bytes, letting analysts carve an embedded executable that is a genuine Microsoft LockScreenContentServer.exe used for DLL side-loading; two further PNGs each contain half of a malicious DLL that is concatenated to form the final payload. On Sep 22 and Sep 25, SANS documented a second campaign it named 'Macfinger ClickFix': scripts from velvet-otter-glagceis[.]life injected into legitimate websites fingerprint macOS visitors, who are shown a fake bot-protection/CAPTCHA verification prompt. In the Sep 22 account, victims download a 4,674-byte bash script from 45.150.33[.]128; in the Sep 25 analysis of a 2026-09-24 infection, victims paste a shell command that downloads a loader from 45.131.215.56 — the two reports cite different payload-hosting IPs. Both report roughly 33MB architecture-specific Mach-O payloads (arm64 and x86_64). The installed binary masquerades as com.apple.periodic in /Library/Caches and persists via a LaunchAgent plist (com.apple.softwareupdated.plist) running a copy from that directory. The malware communicates with C2 at 95.163.153[.]80:8133 (described as WebSocket-based in the Sep 25 post), issuing tracking POSTs to /api/t and exfiltrating stolen data to /api/credentials, and prompts victims for administrator and macOS Keychain passwords. SANS concludes the stealer is distinct from Atomic macOS (AMOS) Stealer, citing differences in persistence, exfiltration, and architecture. SHA-256 hashes, URLs, and an infection traffic timeline from 2026-09-21/22 were published as IOCs.

• TerminalFix PNGs are structurally valid (IHDR/IDAT/IEND, RGBA, 111x112 pixels) but use all pixel bits to encode payload data, not LSB steganography.
• The raw bitmap begins with a little-endian PE length of 49,720 bytes, enabling carving of the embedded executable — a genuine Microsoft LockScreenContentServer.exe used for DLL side-loading.
• Two additional PNGs each store half of a malicious DLL; concatenating the parts yields the payload.
• Microsoft Security Research reported TerminalFix as a multistage intrusion deploying a reverse tunnel.
• Macfinger ClickFix injects a script from velvet-otter-glagceis[.]life into legitimate websites to fingerprint macOS visitors, then presents a fake bot-protection/CAPTCHA verification prompt.
• Initial delivery is a 4,674-byte bash script pulled from 45.150.33[.]128 (Sep 22 report); the Sep 25 analysis describes a pasted shell command downloading a loader from 45.131.215.56 — sources differ on the payload-hosting IP.
• Payloads are roughly 33MB, architecture-specific Mach-O binaries for arm64 and x86_64.
• The installed binary masquerades as com.apple.periodic in /Library/Caches; persistence is via a LaunchAgent plist, com.apple.softwareupdated.plist, running a copy from /Library/Caches.