TerminalFix: PNG Steganography, (Mon, Sep 21st)

2026-09-22T01:23:41Z•c0d32a0c82caf67c54c613341eff12b3d536424f8968a6026c5f7fcb2d1b5fd2

HTTP QUERYLausivLoaderPNG steganographyTerminalFixcommand-and-controlhospitality applicationsinitial accessmacOSmalspammalwaremultistage intrusionpayload stagingphishingreverse tunnelweb scanning

Open source link →

What happened

SANS Internet Storm Center entries from September 2026 covering the TerminalFix malware campaign’s use of PNG steganography and reverse tunneling, LausivLoader multistage malware delivery through malspam, scanning against hospitality applications, HTTP QUERY method changes, and macOS 27 boot traffic. The primary security-relevant items involve malware staging, phishing, covert data concealment, and command-and-control tunneling.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sans_isc_diary
Record identifier: c0d32a0c82caf67c54c613341eff12b3d536424f8968a6026c5f7fcb2d1b5fd2
Enrichment time: 2026-09-22T01:23:41Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records