TerminalFix: PNG Steganography, (Mon, Sep 21st)
2026-09-21T13:23:41Z•b68b558d729bffa7334c893dd1b4f460fd5c2f8358f02b9ffffe1fc6f37a510a
HTTP QUERYLausivLoaderPNG steganographyTerminalFixcommand and controlhospitality applicationsinitial accessmacOS telemetrymalspammalware campaignmultistage intrusionphishingreverse tunnelthreat intelligenceweb scanning
What happened
SANS ISC Diary feed containing recent security articles, including the TerminalFix malware campaign using multistage intrusion, reverse tunneling, and PNG steganography; LausivLoader malware delivery and inter-stage data transfer; scans targeting hospitality applications; and macOS 27 boot-network telemetry. The feed also discusses the newly defined HTTP QUERY method. No specific CVEs or concrete indicators are included in the supplied metadata.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- b68b558d729bffa7334c893dd1b4f460fd5c2f8358f02b9ffffe1fc6f37a510a
- Enrichment time
- 2026-09-21T13:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.