TerminalFix campaign deploys a reverse tunnel through multistage intrusion

By Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan, Parasharan Raghavan

Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique…