TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft has revealed information about a new variant of ClickFix, called TerminalFix, which deceives users into executing a malicious command in Windows Terminal or PowerShell. This variant differs from traditional ClickFix campaigns in that it directs victims to Windows Terminal or PowerShell rather than the Windows Run dialog, potentially increasing the success rate of complex attacks. TerminalFix uses fake Cloudflare CAPTCHAs as part of its deployment process for a reverse-tunnel backdoor. The technique used by TerminalFix campaigns is similar to traditional ClickFix campaigns, but with a modified approach to target Windows Terminal or PowerShell. The use of fake CAPTCHAs is a tactic to trick users into running the malicious command. The attack aims to deploy a reverse-tunnel backdoor