Microsoft Warns of TerminalFix ClickFix Variant Deploying Reverse Tunnels via Fake Cloudflare CAPTCHA

Microsoft security researchers have identified a new ClickFix variant, tracked as TerminalFix, being used in active attacks. The modus operandi involves compromising websites and injecting fake Cloudflare CAPTCHA challenges. Unlike legitimate CAPTCHAs designed to distinguish humans from bots, these fake prompts are designed to lure visitors into executing a specific PowerShell command. Security experts report that running the command opens Windows Terminal and executes a payload that establishes a reverse tunnel connection back to the attacker's infrastructure. This technique allows threat actors to gain remote access to the victim's machine, potentially leading to data exfiltration, ransomware deployment, or further network lateral movement. The use of Windows Terminal in this manner is notable, as it provides a familiar interface that may lower the victim's suspicion. Microsoft and Cloudflare are currently monitoring the campaign and working to identify the full scope and origin of the attacks. As of now, no specific software patch has been released, but the advisory emphasizes user vigilance and the importance of keeping systems updated. The investigation into the threat actors behind TerminalFix is ongoing.