Overview
- Security researchers at Microsoft described a campaign that starts with compromised sites showing a realistic Cloudflare-style CAPTCHA that asks victims to paste multi-line PowerShell into Windows Terminal.
- The delivered loader unzips a legitimate signed executable and a malicious DLL that is side-loaded to run malware restored from three PNG images using steganography.
- The malware establishes persistence with a per-user Registry Run key and an hourly scheduled task, then performs Active Directory and internal service reconnaissance.
- A custom Python client connects outbound over TLS WebSockets to gitnow.dev:443 and can multiplex SOCKS5-style arbitrary TCP connections to internal IPs and hostnames.
- Microsoft has published indicators of compromise and mitigation guidance and noted no confirmed hands-on credential theft or data exfiltration in analyzed cases; defenders are advised to block known C2, restrict and log PowerShell/Terminal use, enable Script Block Logging, hunt for nonstandard LockScreenContentServer.exe activity and PNG payload requests, isolate affected hosts, and rotate exposed credentials.