Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to deliver a reverse-tunnel backdoor

62/100

Microsoft has disclosed TerminalFix, a ClickFix variant that uses fake Cloudflare CAPTCHA pages to trick users into running malicious commands in Windows Terminal or PowerShell, rather than the Windows Run dialog, leading to a reverse-tunnel backdoor. Defenders should brief users on fake CAPTCHA lures and monitor for suspicious user-initiated PowerShell or Terminal commands.