Microsoft Identifies TerminalFix Malware Using Spoofed Cloudflare CAPTCHAs for Reverse-Tunnel Attacks

Microsoft identifies TerminalFix, a malware variant using spoofed Cloudflare CAPTCHAs to deploy a reverse-tunnel backdoor via PowerShell. The attack employs DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance to enable persistent network access and potential data exfiltration.

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell.

"While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex

Read original article